Gramski

As always; it depends on requirements. If they want a simple enough blog then WordPress is fine. It won't take much to get up to speed either. The main limitation is that an install of WordPress just gets you a framework and a rather limited one at that. The money pit concern is valid. WordPress code might be free but they do need to host the site somewhere reliable and if they want to start doing fancy stuff, selling stuff etc. then they either need to pay for plugins or learn to code.

One suggestion above was Squarespace but running a shop seems to cost £17 a month. They'd need to weigh up that cost against the cost of hosting the website with a hosting company (probably around £80 - £100 per year inc. VAT) and running something like WooCommerce on WordPress (free but painful and likely to suck up time). £17 per month might not sound so expensive by the time they factor in what it provides (I've never used Squarespace or Wix so can't comment). 

Vulnerabilities exist in any system; if you keep WordPress up to date then I don't think it is any more or less secure than other options. The plugins are where I'd be most concerned in terms of vulnerabilities especially if you start to choose less known developers from exotic destinations. 

I don't have time to get involved in any project but am happy to help in terms of a discussion \ bouncing some ideas as I run a couple of WordPress sites (one for a charity and one for the wife).