They don't have to, Wordpress updates itself by default. Most Wordpress-sites are hacked through plugins like Revslider (lots of people are still running that old version from early 2014) - usually pirated premium plugins (or themes).
My problem lies in reconciling my gross habits with my net income. -- Errol Flynn Any man who has $10,000 left when he dies is a failure. -- Errol Flynn