WordPress websites are vulnerable to hackers because they load page contents from a database leaving Plugins and Themes open to attack.
There’s no database to exploit, which means there’s nothing to attack.
When you load a web page from WordPress, the database has to load everything. Every time.
A Static website skips all of that and just serves up the page instantly.