And I agree that more exploits are found, due to it’s popularity. But if we think about it, they are made from the same “base”. Php and sql. A simple incorrect code, and you can do an sql injection and such 
Even known CMS release once in a while a security update, due to similar problems. I was hacked once, on a website that is fairly popular. It was not a pretty thing…