Safety (relative) and security of WordPress … comments?

This is not a support question – but, rather, a more general request for comment from anyone who may care to offer their opinion/knowledge on the subject.

I’m opposed (strongly) to a proposal to spend $500,000 to hire a web development team to create a “secure” website using Dreamweaver, “because WordPress is not secure.”

I strongly disagree with that, and in fact would suggest that WordPress is MORE secure if for no other reason than there is a world of people looking for, researching, identifying and fixing security flaws and issues, and issuing updates on a timely and regular basis. With a customized, one off, web “solution” there are arguably just as many (possibly more) potentially security concerns and they are NOT backed by thousands of people looking for them and looking to fix them. In fact, with a custom one-off solution security issues may sit undetected and unresolved for weeks, months or years until something major happens (e.g., a major security/privacy breach) at which point it is too late. Big banks, and huge organizations are “hacked” and have IT and web security issues and breaches all the time … and I’d suggest that MOST of them were not using WordPress. So the idea that somehow WordPress is “less secure” seems to me to be a wrong and, perhaps, dangerous assumption. Dangerous if it means you go with a less secure option because you have this mindset that “free” and “open source” must be bad and insecure and “you get what you pay for.”