Is WordPress security getting better or worse?

Sloppy statistics and sketchy incentives are damaging WordPress’s security reputation, even though the core software keeps getting better.