WordPress/PHP does have a really interesting design that allows you to essentially hot swap components while the website is running live.
What I mean is that you can install WordPress plugins with WordPress itself, live. The PHP scripts which are essentially files in a folder, will go download more PHP files essentially augmenting itself without ever having to restart or redeploy the server.
It's an interesting capability that few other web frameworks have.
Being able to install plugins from the web interface exposes the site to more security issues. Those who can manage to follow some instructions would be better off logging in to the host via ssh and then using the wp-cli [1] command to manage the site (upgrading WordPress core, installing/uninstalling/upgrading plugins and themes, etc.).
What I mean is that you can install WordPress plugins with WordPress itself, live. The PHP scripts which are essentially files in a folder, will go download more PHP files essentially augmenting itself without ever having to restart or redeploy the server.
It's an interesting capability that few other web frameworks have.