What the necessity of plugins really boils down to is the question, "Am I satisfied that WordPress's core functionality is all that I need?"
If all you want is a simple blog with some categories and a number of static pages you're set. But if you want to start integrating interactive maps, calenders with events, maybe a 3rd-party REST API, force users to use strong passwords, or even turn the site into a social network then you need plugins. Grant Palin's answer provides more insight into why one might desire plugins. Dan Gayle's answer points out that many themes provide all sorts of plugin functionality without explicitly using WordPress plugins.
The WordPress core itself is considerably secure, and the core developer community does a respectable job isolating and patching security vulnerabilities as soon as they are identified - one of the benefits of having hundreds of millions of users and an average of around 200 core contributors per release. And the risk that used to be present for the duration between the identification of a vulnerability and the release of its fix is quickly being eliminated with the addition of Automatic Core Updates.
WordPress security infographic from Pagely (Fair amount of solid info - click through to view it in its entirety)
Yes, WordPress has inherent security vulnerabilities. But so do Drupal, CakePHP, Ruby on Rails, Symfony, Zend, etc.... There is no platform or system that I would use without implementing additional security precautions in addition to those already provided by the platform. I think it simply a bad idea to rely on the CMS or framework alone for the front-line security of any website, especially any framework with notable adoption rates.
Plugins are not definitively insecure. The problem is that plugins are not vetted to ensure that their authors followed good security practices. WordPress has set forth a number of standards that authors should follow, but many plugins are authored by novices or others who ignore the standards. But as with all code-bases in existence, the more code you add to a system, the greater the likelihood of introducing bugs and vulnerabilities. The more plugins you add to your installation, the greater the risk you tend to take. By the same means, know that WordPress themes present an equally malicious threat - particularly the slews of "free themes" available from obscure theme-sites, many of which attempt to directly exploit your site rather than innocently exposing security vulnerabilities through ignorance or accident. Only obtain themes and plugins from trusted sources and credible authors.
A rule of thumb is to not install plugins from widely unknown authors or plugins that are relatively new on the scene. If you can, take the time to establish the author's credibility. Ideally, learn the factors that go into a well-secured plugin (numbers-used-once [a.k.a. "nonce"s] for request and URL authentication, input sanitization, output escaping, prevention of direct access to plugin files, proper access of the database through WordPress methods and functions, the absence of errors and deprecation notices when debugging is enabled [refrain from enabling it in production environments], etc.) and vet every plugin you install yourself. There is no substitute for understanding what goes into secure plugin script, nor any better defense from crappy plugins.
If the thought of insecure plugins and themes frightens you or you are not familiar with or seeking to become familiar with PHP, you may find the services of WordPress.com to be more your cup of tea as they assume responsibility for vetting plugins and themes and only allow those determined to be secure to be installed on users' sites. You may still use a custom domain with WordPress.com if desired.
Back it Up
Some hosts provide such services, others don't. Just as I don't trust the security of any platform to stand on it's own, I don't trust any host to take care of my backups. Rather, I prefer to have my backups pile up in my Dropbox and synced to different servers so that I can be confident that I always have direct access to my backups with copies on several different systems. If my host goes down or is bought out by a larger company or some other hosting misfortune, my sites are a few clicks away without even the risk of having to deal with my host's support.
You should read the codex entry on Hardening WordPress for more security advice. If you don't think that you should need many plugins or any obscure plugins in the future, it may well be wiser to have WordPress.com or an alternate managed WordPress hosting provider such as Pagely host your blog.
Regardless of the new "Automatic Core Updates" feature of WordPress, you should still strive to manually ensure that your installation and all of your plugins and themes are up to date. Some might think it excessive, but I like to enable debugging after an update and ensure that no plugins or themes have lost compatibility (a stream of errors and deprecation notices is a strong symptom of this). If they have, I disable them until their authors update them, or make the necessary changes myself to hold me over until they release an official update. Note that you should either take your website offline or run an offline development copy of your website before you enable debugging to troubleshoot anything.
I am not sure as to the prevalence of the Ad-sense click-bombing practice, but a WordPress plugin offering to mitigate the effects of such click-bombs is offering you an additional layer of security in addition to whatever precautions Google has in place. Websites not running WordPress face the same exact threat regarding click-bombing, and either must implement protection by other means or survive without it.