Because a wordpress[1] site with a $20 template is all most small businesses need for their brochureware site. The average small business needs a website with their hours, phone number, some pictures, and maybe a blog that they'll never actually update, but they don't really know the difference between paying someone to set up wordpress and paying someone to build a bespoke web application. The only reason the majori…
Until they insist on using the email service that is packaged with the shared hosting plan. And they, or an unwitting employee, start using it to communicate information they shouldn't. And their account gets owned. (Keep in mind, the content is no longer just public web pages...) And... Even if the web site hosting should have been done this way, they still needed help/advice/pressure to be more clueful about their…
It is really hard to have vulerabilities with static html. Similarly, hosting these costs nothing. Usually in the ballpark of $3/year, the DNS alone is the dominate cost. And if they do get a sudden inrush of traffic, static hosts need to see a thousand times more load than stock wordpress before they fall down.
Come to think of it, I've never had a client that was the correct size for Wordpress. They were either way too small or way too large.