I don't blindly believe what people say on the internet.
I only believe something if there's a practical evidence.
I have numerous websites built on Wordpress and haven't faced anything like that ever.
I don't have much experience with niches Google hates as mostly these sites are niche websites, or local business websites.
The problem is most people install weak themes and plugins. And they leave wp-admin available to everyone (locking it is mandatory).
Google AI based crawlers can scan those, easily, as they claim to scan everything.
If they didn't scan, how would they tell the difference between a phishing and a normal site?
If you use WordPress, use a theme that doesn't leave footprints and make your WordPress site work like it's not a WordPress site.
WordPress provides an API to query database, so you can use that. https://developer.wordpress.org/rest-api/
See WordPress as a framework for backend. Do frontend separately.
WordPress itself was / is hackable, without any themes. https://www.blackhatworld.com/seo/wordpress-6-0-2-update-asap.1434026/#post-15585417
But I think the best way would be to store all data like posts in .csv and .txt and .md files.
If you don't have authentication on your website, don't use database.
If you have authentication on your website, think of some secure solution with encryption.
If you can't afford coding / developers with security insight hired, here's what you can do https://www.google.com/search?q=visual+site+builder
Don't use self-hosted websites with PHP if you're not insightful about code. That's like using Python or Java without understanding them first.
Would you do that? Probably not. So why do you use PHP? That's vogue.