That still leaves a server that can be attacked, and a way to inject code into people's pages through the compiler.

I'm not suggesting it would be in any way easy, it may be nearly impossible, but not having a database isn't the same as being "unhackable."