Magento is ridiculously complex, open-source, and often self-maintained. It's probably fairly easy to exploit, especially for outdated deployments. And (vs. Wordpress) has payment info to intercept.