This is how it began and should stay, when IT teams started to get involved in this they ran heavy overhead and aren't clued in on creative requirements. Stick to keeping emails and erp servers up.

Seems like most main company sites at places I've worked. If you are lucky, that WP instance is a fully managed service where they proactively deal with keeping it on the latest PHP, WordPress, and plug-in versions.

I’ve been to a few places like this and managed to get rid of the Wordpress infestation.