To avoid updates and viruses, go with a static site.
There are a ton of good static site generators out there. My blog[0] runs on Jekyll[1]. Hugo[2] is a popular option. I've fiddled with Gatsby[3] and heard good things. Eleventy[4] looks as close to Jekyll-but-in-JavaScript as I've seen.
Since you want to be able to customize it, I'd probably take the static site generator's language into account. Do you like...
Ruby? -> Jekyll[1]
Go? -> Hugo[2]
JavaScript? -> Gatsby[3] or Eleventy[4]
Some other language? -> google "[language] static site generator" and see how many GitHub stars it has.
Once you've figured that out, most of the hosts support custom domains. Netlify[5] is free, and works very well. It's what I use currently. I used to host my site on DigitalOcean[6], but Netlify is definitely more painless, especially from a devops/patching standpoint. Plus it has a CDN so your site would be faster.
[0] https://daveceddia.com/
[1] https://jekyllrb.com/
[2] https://gohugo.io/
[3] https://www.gatsbyjs.org/
[4] https://www.11ty.io/
[5] https://www.netlify.com/
[6] https://www.digitalocean.com/