1) That depends on who is building the custom PHP site and how much effort they put into it. If you build a shoddy custom PHP site, then it can easily be hacked. On the other hand, if you don’t take certain precautions then your WP site can be hacked too. I just finished up a site for a U.S. Congressman, and their IT guys tried to hack it but couldn’t so they approved it for usage. If WP can be secure enough for the US Govt, it should be fine for your NGO.
2) No framework or CMS is “more SEO friendly”. Some are EASIER to setup than others, but at the end of the day it’s up to the developer to make sure you have proper h1, h2, etc tags. Meta tags, alt tags, unique content, etc etc. WordPress has tons of plugins that make your job A LOT easier in that regard.
3) Way easier to edit content, post new content, etc than a custom built php site. Development time is drastically reduced because everything is built for you.