Linux is absolutely popular for servers. If you put a WordPress installation on the IPv4 address space, or any other kind of PHP you usually find a webshell has appeared after just a few minutes.

true, i get these attempts on my server daily. but here too you got less popular alternatives, so the same principle applies.

This totally isn't true. Sure, if you load it with vulnerable plugins, but otherwise this type of FUD helps nobody.

well, the problem is that a lot of people do load vulnerable plugins and that makes wordpress an attractive target.