Plugins are not sandboxed. A flaw in a contact form, backup or page-builder plugin can expose the whole site, including the database credentials in wp-config.php and the files in the uploads folder.
Every plugin adds attack surface and depends on its author for fixes. Abandoned plugins may never be patched, and a plugin that is deactivated but still present on disk can often still be requested directly, so it can remain exploitable.
Keep an inventory of installed plugins and their versions, remove what you do not use, update promptly after a security advisory, and replace plugins that are no longer maintained.