Indeed, Milo - No 1 son runs a hosting company and repeated infections are occurring on those clients who use WP for their sites. The latest followed a complete re-install of the latest WP package and only with difficulty did he find the hack lay in the SQL tables - lesson learned!
WP is indeed a clever and reasonably simple system for site creation, but as you say is rapidly becoming the target for hackers due to its widespread coverage. A typical infection can sometimes leave the website 'untouched' but generate sufficient spam mails to cause the mail server to be blacklisted.
I 'played' with it a while back and ceased 'playing', but left the folder on my server, and because I ignored it from then on, did not patch it. Sure enough, along came the dreaded 'arabic' hack.