In a private-origin, public-static setup, visitors do not hit <code>wp-login.php</code>, plugin PHP code, or database-backed page generation on the public site. This reduces the blast radius of many common WordPress risks, including plugin runtime vulnerabilities, automated login probing, and server-side behavior that only exists while WordPress is serving each request.