There is now a huge security concern about the WordPress platform.
And as you rightly said, web server security and database security are more important.
Apart from that, we need to check other things like taking regular backups, keeping software updated, installing antivirus and firewall , using strong password , use of lightweight theme, installing wordpress security plugins , etc.