Wordpress can manage millions of users. Yes, wordpress can manage millions of users. In fact, some of the biggest websites on the Internet today with millions and millions of users are powered by WordPress. There is no strict limit on the number of users a Wordpress site can handle.
WordPress dominates 65% of the CMS market share and for good reason. It is easy to use, scales according to your needs, and is completely free to use. You don't have to upload full videos to your WordPress page when you can offer a faster experience by embedding a YouTube or Vimeo link. If you want to handle a lot of traffic and scale from WordPress, you should do everything you can to reduce HTTP requests.
If you want to optimize your website, that means using as many native WordPress features as you can. WordPress pages are the standard built-in post type that allows you to publish content to your WordPress blog. The server itself is a Linux container with 1 vCPU, 2 Gigabytes of RAM, running NGINX and PHP-FPM with a WordPress backend. That said, your friend's website doesn't go from 0 to 1 million users in a short period of time.
In addition to using a security plugin, there are other things you can do to improve the security of your WordPress website. Finally, I also outlined some quick and easy steps you can take right now to help strengthen your WordPress website and its ability to handle heavy traffic as well. As wordpress doesn't have much dynamic content, this can be achieved with some nginx and cloudflare reverse proxies. Despite the fact that plugins perform automated testing and corrections, your WordPress website is not yet completely secure with just one plugin.
It's not the content management system that determines how many users your WordPress website or any WordPress website can handle, but it's the resources of the server and your web hosting provider that are likely to determine how well and how many users your WordPress website can handle. The platform is open source, so any limitations on users or the number of pages a WordPress site can have are due to these underlying coding languages. WordPress is a popular website builder, but it's not a website host, so you can't limit the number of users a website can have. They have an average of around 1.7 million visitors per month, so people accessing the same WordPress site at the same time is no problem.