You're not wrong, but I would like to point out that I've had some communication with Sucuri in the past, back when a number of Wordpress sites got eaten. (I should probably narrow that down a bit more!)

They seem quite capable. Bluehost provides reasonable access logs by default for their sites (I've had clients with sites hosted there), and if there was password guessing going on through a web interface, I would expect that Sucuri had noticed that.

It's possible that some sites were brute-forced via FTP or SFTP, but if Bluehost isn't already monitoring for that and preemptively dealing with it, I'd be very surprised.

So I think there's something else going on, and I'd really love to find out what it is. Unfortunately, none of the hosts seem to be 'fessing up to what compromised their sites. They keep pointing to WordPress, which is bullshit in at least one recent case. (I was involved in that one, and it was a fully-up-to-date-at-the-time 2.9.2 installation, and there was no evidence of a compromise in the access logs, which I spent hours examining very, very carefully.)