Wordpress is by no means a CMS, just a overexploited blog system.
Drupal is relatively ok, but a hassle to update core and extensions.
Joomla or Contao are both fine for out-of-the-box CMS functionality for small to medium-sized websites with standard functionality.
TYPO3 is the most feature-rich, enterprise-ready Open Source CMS out there, I have been using it as a professional web developer since 2007
and love it for Typoscript and the speed that you can react to customer changing requirements during project or adding new ones.
It also has a great, big community with a special security team fixing security holes in extensions and core lightning-fast.
Btw. dont trust these "how many security holes has the CMS got in the last 10 years" statistics.
Smaller CMS or Drupal simply get better off sometimes there as they are not as complex and simply because the ppl dont look for security holes
in the professional way the TYPO3 ppl do ;).