> And that is insecure Wordpress: people lego-mounting sites without touching code, only with plugins.

Works as intended, that's why WP has been so popular