I literally just had a conversation with my coworker who is not a dev where he said that WordPress sites getting hacked is a myth. He also thinks shared hosting sites getting hacked is also a myth......I literally can't right now.

Hack him.

There's more evidence of wordpress sites being insecure swiss cheese than of him existing, so. Tell him he's a myth.

I find this especially funny thinking back to the WordPress site I hacked today 😄 (on my own machine, test setup)

Also, being an ex (shared) hosting company employee, I can confirm that helping people with cleaning up hacked (WordPress) sites was a part of my daily work!

Sometimes, the only thing to do is say "...right....", very slowly, with a raised eyebrow, and walk off, laughing and shaking your head.