Fix the site, because you built it and in the future. Build it in to your hosting fee. A monthly amount that will pay you to fix the site after it has been hacked and to keep Wordpress and plugins updated.
You can outsource the security and about £6.00 a month.