A standard website from us is plain files served from Cloudflare’s global network, with no PHP, no database, no plugins and no admin login, so there is very little that can go wrong. When a big PHP or WordPress flaw makes the news, there is nothing on it that needs patching. The contact form runs on Cloudflare’s own platform, which Cloudflare keeps updated.
Bigger builds, like online shops, bookings or customer logins, do run code and store data, so there is more to look after. We build those on Cloudflare’s platform as well, so the servers and the software underneath are patched by Cloudflare. Our own code we keep small and fix ourselves, and a fix reaches every site we run within minutes. How this compares to WordPress.