Free Wordpress themes coming with a price
Wordpress isn't responsible; the faults are due to the design of PHP. The availability of the eval() and base64_encode() make these sorts of attacks basically unpreventable in untrusted sources.