One of my first jobs I got hired as a web developer for, wholly unqualified but likely foreshadowing, was using Joomla only, I got an ick in Joomla from then because the owner closed shop on us over a weekend. I never used Joomla again and after that when I got my first decent project a couple years later I dove into Wordpress and for client work which I prefer to build hand over and not be bothered with again it really is a bit of a swiss army knife.

I think one of the biggest things with Wordpress is to really start with a good theme, the one I currently use for almost every site is Virtue from Kadence and although it is now being phased out since they are working on better themes with more features the cost was just $45 a year for unlimited sites. Their new pricing model is a bit irritating since things like Elementor and Divi theme which are basically entire site builders charge plenty for limited sites. So seems the market is looking at about $150+ a year for a solid theme page builder. Depending what it is for that can be worth it or not.

I have not needed to but I am sure there are still some solid free options available, especially if you aren't trying to be all super fancy and shit. A good starting theme will help you avoid stupid plugin requirements that add bits and bobs. Mainly if a plugin has some decent downloads it should be fine, and I think the only ones to be wary of are ones that really affect the system. Something like one I needed recently to allow epub uploads it affects how wordpress handles files, the first plugin fucked with my interface so I quickly got rid of it. Other than that the ones that are very useful can also be a bit detrimental, like the supposed optimization ones, they can hurt your workflow and just make it irritating to constantly have to clear cache etc.

It all comes down to compromise, always just ask do I really need this feature this way or can I accomplish it with something already available from what I have. Barebones, you should be fine running an entire ecommerce setup with a good theme, woocommerce, and about 5 other convenience plugins.

honestly hacking is also many times going to come from your server setup, if you are using shared hosting , ie like "we offer wordpress hosting" for $5 all good and well usually since they do config things pretty well in the back, I host mine on a VPS I rent so I run multiple sites with my own php,mariaDB and Nginx setup, I need to isolate those pretty well and each has their own passwordless account with no priveleges etc etc.

The other reason unless it truly is a malicious plugin, is usually people not maintaining updates, or choosing plugins which have shown no activity for the longest time. I have only ever seen 2 Wordpress hacks the one was server backdoor with a shit host and the other I honestly have no clue but restored the backup and all good again.