Yeah I've actually had several wordpress sites I've been involved with in years past get hacked before. One was the guy I built the site for refusing to keep it updated (this was before auto-update). The other if I recall correctly wasn't the fault of our site but some other site got compromised on the shared server and the attacker was able to hit all the sites on the server. You can see why I'm always a bit wary of WP even if it is irrational.