What about WordPress security versus Laravel security?

Both can be secure when maintained properly, both can be insecure when neglected. WordPress has a larger attack surface because the plugin ecosystem (60,000 plus plugins) introduces unmaintained code into production sites. Laravel applications have a smaller attack surface because dependencies are explicit in composer.json and the framework defaults handle common vulnerabilities (CSRF, SQL injection, XSS) consistently. In practice, WordPress sites in the wild see more compromises because more WordPress sites exist and many run abandoned plugins. A Laravel application maintained by a competent team is structurally safer than a WordPress site with 40 plugins and an absent webmaster.