I'd be curious if anyone has data on this, but I think hacking sites is a much more common vector.
https://duckduckgo.com/?q=wordpress+hacked+malware&t=ffnt
If an Ad Blocker is the only thing standing in the way of you and an exploit, you're gonna have a bad day.