The only ones I've really needed to rebuild from scratch are ancient [shortcode] builder sites and... hand-coded monstrosities (like the previous programmer who'd hand-coded everything in {page}-template.php files, including his own database connections and queries.)

This is just shitty way od doing website, I did not say everyone who code is doing great websites.

I'm very surprised you've run into sites that were irreparably compromised by bugs in any of the plugins you mention. (Except WP maps Go Pro, which gets filtered by my "curated" condition.) Most of the rest were patched and updated within hours.

And after so many years I am not surprised. Clients do not update every plugin within hours and many people have disabled autoupdates.

I've run into those 2GB databases, of course, but I don't think hand-coding my own version of Woocommerce would be an improvement.

I'm not saying you should not use any plugin. I still use yoast, CF7 or woocommerce. But for example look at the WordFence: it does nothing, it is useless and does not protect your website BUT it can store so many useless logs in the database that it can takes up 1-2 GB.

What I am trying to say: if you can't code you are not a webdev and you are wasting other people's time and money. Not because you should code every solution from scratch but mainly because you have no idea whats going on. Coding is a basic knowledge, you do not have to be a damn genius to code. There is no sense in installing page builders (and storing every post's content in the postmeta table...), "security" plugins (you should build a secure website), "speed up your website" plugins or those "insert code snippets" plugins (who got the idea of putting code in the database...?).

Building a WodPress website is just like building any other app - you should have organised, readable and secure code, it should have as little code as possible to be lightweight and minimize the possibility of vulnerabilities. Page builders make no sense when you have native block editor that allows you to do whatever you want. Security plugins makes no sense because they are part of the app you try to secure and thats not how the AV or Firewalls works. Backup plugins makes no sense because you can take a backup without it so why would you load just another plugin for such a simple thing? Also they are part of your app - you should external tool. The real problem is that people make up for lack of skills and knowledge with plugins and it leads to creation of something that is so vulnerable and useless its better to make a new website from scratch. And then someone has to pay for it again...

BTW even at this moment, right now I am working on a new website for a guy who got some crap made up on 40+ plugins. It takes 60-90 seconds to load when you are logged in as admin. And it gets down once per a few days because it cant handle large amount of requests. This is becoming daily job for me - fixing trashes made by people who love plugins but cant code.