Years ago in the early days of WordPress, everything was free. You either chose a boring default theme, picked one someone else had created or wrote your own theme. Then two things happened: 1) people realized they need to make money and 2) hackers discovered themes are a way to create security holes.