Yes! We know that Drupal is quite a secure platform for the business. But it is still not completely secured from the hands of hackers. Of course Drupal has many security experts who work continuously to check for weaknesses in the core.
Whether you have a small or large project, you need to keep in mind that it can be targeted by the spammers. Now the major issue here is once the word related to the security issue goes out, the hackers will be scanning the web to just look for those vulnerabilities.
So be wise enough in terms of your website security, always update the new security patch available regularly. However, a Drupal site that is regularly maintained & updated on issues will perform as expected and it will also save your lot of expenses in the long run.