As a developer, I have developed WP sites.
Back in the day WP was more of a blogging platform and I was developing websites, so I used Joomla for client sites.
Still do.
Remember the days when Apple products were immune to malware?
Now they are vulnerable just like PC's
Well WP is the biggest platform for websites now and is constantly attacked.
I am not saying Joomla is not attacked, but it is nothing like what happens to WP sites.
I have systems setup on my Joomla sites to record attacks and I can honestly say that 99.9% of the attacks I catch have code aimed at WP and have no effect on Joomla sites they randomly attack.
I may be biased, but I think Joomla is underrated and is a great option for building sites, and it is more secure than WP because it is targeted less.