Just like securing a system is a trade-off, attacking one is too. Risk vs reward and time vs reward. Your personal blog doesn't need to be fort Knox, just patch it properly and you should be fine.

The software is better in the end but not all of it will be productive.