Comment by prepend

They can certainly be hacked, just like any static site. Web servers have vulnerabilities.

And the files can certainly be edited as they aren’t immutable.

They are less resource intensive and easier to maintain, but aren’t immune.

(Running mostly static sites converted from Wordpress sites, but also running 10 year old+ word press sites that haven’t been changed in forever)