> [...] and/or with unverified extensions, is a large part of the current level of issues

I'm occasionally forced to work with Wordpress, so I'm not an expert or anything, but that's my impression as well. Wordpress was designed for publishing articles but people want to use it as a foundation for building highly dynamic websites.

The paradox of these highly dynamic WP websites is that people usually try to build that way because they don't have the development expertise to make a custom solution, so they need lots of plugins to achieve what they want, but those plugins are often built to such poor quality and security standards that they really need to be reviewed before use, but to review them you need developer expertise.