When the code executes on server, it opens a number of attack vectors whereas static site has little or no server-side functionality. All the attacker can do is deface the pages and nothing else.
Static sites are pre-generated HTML pages, so while the website is opening there is no sever or database request which increases the page speed gradually.
A static site will always perform better than any CMS. Static site are pre-chached pages which never expires.
And get best offers in your mail box