A static website is built ahead of time into plain HTML, CSS and image files and served from a global network. There's no PHP running, no database, no plugins and no admin login on the public site. Most WordPress break-ins come through a plugin that wasn't patched fast enough, so a static site removes that whole category of risk instead of managing it.
WordPress can be run securely, but it takes ongoing effort and the effort never ends: core, theme and every plugin need updates, and a plugin that falls behind is the usual way in.
A static site is different in kind. The pages are built from source files in a private repository, then published as finished files. When someone visits, there’s no code on the server to exploit, no database to query and no login page to guess at. Every deploy is rebuilt from source, so a tampered file can’t persist.
It’s also why static sites are fast: the pages are already built when the visitor arrives.