Most of my design websites using joomla, wordpress and drupal have been hacked. This is a big problems for web site owners.
It is ok as we are web design companies if we are not responsible for upgrading. We have more things to do now, a lot of clients asked us to upgrade their websites.
We need to give clients some options, and let them know the free CMS is born to be attacked. Joomla etc is powerful, yet it is vulnerable in term of security. Clients need to know it is risky if they request those CMS.