We build 99% of our websites in WordPress. There's just very rarely no reason not to. It's the most "non-technical content-management friendly" platform available, and it doesn't have the brick walls that SquareSpace does or the Theme Limitations that Shopify has.
And, security should never be an excuse with WordPress. You can lock it down and get a good webhost, and you'll be all set.
But one annoying thing is comment spam on blog posts. Every WordPress site, regardless of how many blog posts it has, will surely get comment spam.
The good news is that the spam won't be visible to your audience, but it will go to your email inbox if you're the site admin, and it will just be well, flat out annoying.
This simple video shows you how to turn off WordPress comment alerts. :)
Sports Card Strategy Show