> How is it more secure when you're still accessing an API?
It only accesses the API with a read-only token during the build process.
> it's not really a dynamic site in the first place and can also be done with HTML or markdown in the same repo
This is definitely true and was an option we considered, however colocating hundreds+ posts with code made the repo unnecessarily heavy and slowed our build time drastically. Our content creators also didn't want to use git to edit their content (they would have to learn git / or use the web UI which is a suboptimal editing experience), nor did I want content creators in our repos.
> The fine control seems the be the only real advantage, at the cost of more moving pieces.
Lots of other advantages that I won't outline here, but our data is completely decoupled from our frontend now, so we can do cool stuff like crossposting to different properties via webhook, data cleanup via API (I ran all the blog posts from WP through some remark tools so we have a more standard look and feel), etc... Might not be the right setup for you, but it works really well for us!
In our case, we moved a blog from WP to a static Gatsby.js site. It's hosted on Netlify and all content is driven by Contentful where updates trigger a webhook on Netlify to rebuild the blog (new posts are pulled during this build process).