WordPress is simultaneously amazing and terrible. At its best, it's a highly extensible free and open source CMS that's incredibly easy to set up and customize. For that matter, its core has reasonably good security and performance before third-party themes and plugins are added into the mix.
The problem comes in with how many basic GUI-based features it's still missing out of the box 21 years later. Take, for example, the curious case of the lack of post cloning; Why is there still no "Duplicate Post" button in the core after 21 years? Why are over 4 million websites being forced to keep a third-party "Yoast Duplicate Post" plugin active in order to access a very basic CMS feature? The same goes for other GUI-based tasks like logging outgoing emails (WP Mail Logging), or viewing the scheduled cron jobs (WP Crontrol), or letting an admin temporarily switch to another user's account (User Switching), or downloading a one-click backup of the site regardless of host (All In One WP Migration), or managing the SMTP settings (FluentSMTP), or managing URL redirects (Redirection), or enabling SVG uploads (SVG Support).
The fact that many of those tasks can be accomplished through small code snippets in the child theme is great and all, but that doesn't help the average WordPress site owner who is barely tech literate and would be more likely to break the site than successfully copy a hook over to the correct file. It's not uncommon to find WordPress sites with 50+ plugins installed, a good chunk of which are abandoned and have multiple code vulnerabilities, yet still find the time to clog up the dashboard with useless "notices", AKA advertisements for their other products.
I could understand a lot of the missing functionality if WordPress was still a small FOSS project with no real funding and a few irregular volunteers, but the fact that's it's grown into what it is without any real plan to address those issues is just so frustrating. I've made a few small contributions to the core and read through a bunch of tickets for longstanding issues, and it's clear that time or funding aren't the problem; it's that the maintainers have an attitude of "We don't personally need that feature ourselves, therefore it can just be a third-party plugin", which might sound fine on paper, but...
Ever clicked on a Google link, only to catch a quick glimpse of the real site before being redirected to an "UPDATE CHROME NOW" or "CRITICAL MICROSOFT ALERT" or "CHEAP PHARMA PILLS" website? There's a 99% chance that site is running WordPress and has dozens of plugins and got hacked at some point, and if you try to message the site's owner to tell them what's happening and how they can fix it, they'll think you're crazy or a scammer and leave the malware there because it intentionally hides itself to logged in users. I'm not exaggerating about that percentage, either; WordPress runs a massive chunk of the modern web (excluding major social media websites), and the failure to quash the need for so many common plugins has made them a goldmine for bad actors to inject redirects and SEO spam.