It's because WP is badly coded software. This 504 error is one thing that can happen when the software is so bloated that PHP times out before it can finish running the Wordpress code. It can also occur during an Apache restart, but that usually goes away on its own within a few minutes.
A stock installation is usually not too bad, but if you add any extensions to it, it becomes so bloated and slow that it usually won't run well if at all. Some extensions are worse than others, but Elementor, WooCommerce, and Wordfence are three that are well known to cause this. If you do get it to run with extensions, odds are you'll end up suspended for high load, which is what usually happens to people who use WP.
People use it because its a well known name, but literally anything else is a better choice.
As for the vulnerabilities showing on a new install, you probably need to update it after installing, especially if you install through Plesk since Plesk tends to have older versions in its software installer. Also, forgetting to update it regularly will usually result in a hacked account (and a subsequent ban when the hacker sets up phishing or sends spam).