As mentioned, updates are vitally important, as are good password practices. I manage many WP sites, and I check (and install) updates every day.
I also have some security things that I do by default to reduce the ‘footprint’. Among them are to not have a user called ‘admin’, disable xmlrpc, strong passwrods everywhere (host, database, FTP users, WP admin-level users, and some htaccess tricks. It got a bit unweildy to remember to do all of those things manually whenever i set up a new site, so I created my own plugin to make it easier to make the security settings I prefer. (It’s called “CellarWeb Privacy and Security Options” in the WP plugin repository.)
AS for cleaning up a site; I’ve had to do those for clients. So I created my own checklist of cleanup procedures here https://www.securitydawg.com/recovering-from-a-hacked-wordpress-site/ . There are many other places to get similar info; I just put them in my site for my reference the next time I needed to clean up a site.
For some sites, I have a custom program that hashes all files and stores those values in a database. I run it once to get a baseline, then run again in the future to see files that have changed. It helps alert me to possible unauthorized changes.
Monitoring your site for changes; keeping everything current; only using plugins/themes from the WP repository; good password practices, and others are helpful to keep the sites I manage clean.