is website application security just a plugin shopping list now? genuinly asking

six security plugins and no backup. that is what i walk into, over and over, and i have stopped being surprised by it. the last one had wordfence, a second firewall plugin, a login limiter, a file change monitor emailing the client every morning, one whose entire job was hiding the login url, and one that renamed the database prefix and broke two other plugins in the process and was still sitting there switched on. no backup anywhere. not on the host, not offsite, nothing. that site got compromied in march and the only reason it came back is that the host keeps seven days of snapshots for their own purposes and one of them happened to be older than the injection. website application security for a small business site is not a product problem, it is that nobody owns the boring parts, and the boring parts are: the software is current, the accounts belong to people who still work there, the backup restores, and somebody looks at the site once a week. i have never once seen a small site compromised through something a WAF would have caught. every single one has been an out of date plugin with a public exploit, or a password reused from a breach, or an admin account belonging to a person who left. the plugins do not do the boring parts. they produce a dashboard with a green tick and a badge saying protected, and the client reads the badge and feels finished. the file change monitor is the worst of the lot, because it emails every day, so by month two it is a rule in outlook, and the one morning it has something real to say nobody opens it. what changed things for me was cutting down rather than adding. one security plugin, updates on a schedule i can see, offsite backups i restore to a throwaway subdomain to prove they work, and ten minutes a month reading the user list and the plugin list. much less impressive to sell and it has held up for years. am i missing something the six plugin crowd knows and i do not?