Comment by kirstenbirgit

WordPress has automatic updates, and you actually have to enter a hard to guess password when creating an account.

The plugin issue is not specific to WordPress.