New comment on reddit

No worries 🙂

If you setup a standalone install of WordPress somewhere, you have several things to pay attention to in addition to content:

• underlying OS updates
• PHP & MySQL/MariaDB updates
• WordPress updates
  • plugins
  • themes
  • WordPress itself

So if you just hand the keys over when you're done, and the client doesn't manage the install, they're going to get affected by some eventual entry on this list: https://www.cvedetails.com/vulnerability-list.php?vendor_id=2337&product_id=4096&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&cweid=0&order=1&trc=294&sha=f7e9f236634d1e8f8f1588d8b60868d41a0af790

I first personally ran into that issue 5 years ago – https://antipaucity.com/2015/04/13/keep-your-wordpress-installs-up-to-date/#.XoX4kG4pChY

If your client is going to manage the system and install updates, then you're fine

If they're not going to do that, going with a hosted option like WordPress.com is probably the much better option – so that they're shielded, as much as possible, from security issues in the future