We've actually inherited clients that run their sites on a wordpress install, so yes it's a viable way to manage a full website and not just a blog, however in general wordpress is known for being a blogging platform and as I understand requires extra work to setup as a full site CMS.

In the "Drawbacks of an Open Source CMS" heading I have the "Security Risks" line that addresses what you're referring to