Them being able to easily change the website is critical for them to be able to do their job. As in most things in life, it is a balance that needs to be achieved and not one thing that trumps everything else.
As others have said, WP gives them a way to easily change the data that they are responsible for. It should be the devs/systems engineers responsibility to make that data present as a static web page using plugins or caching layers and that should be transparent to the marketers.
This leads them to aim for “reasonably performant for the users” as part of optimizing the package of reader + marketer experience.
In that view, IT requirements such as security rank between “should be standard” to “don’t really care” (at least until the first compromise).