What plugins do
WordPress on its own publishes pages and posts. Everything else, from a form that emails you to a complete online store (WooCommerce is a plugin), comes from plugins. There are tens of thousands, free and paid. A developer chooses a small set of well-supported ones and configures them rather than writing those features from scratch, which is a large part of why WordPress sites are affordable to build.
Why the number matters less than the quality
Thirty light, well-maintained plugins can run faster and safer than five badly written ones. What to look for in each plugin: last updated within the past few months, tested with the current WordPress version, many active installations, and a developer who responds to support questions. Plugins abandoned by their authors are the single most common way WordPress sites get hacked, as the WordPress security article explains.
- Remove what you do not use. An inactive plugin still sits on the server and can still be exploited.
- Avoid duplicates. Two SEO plugins or two caching plugins fight each other.
- Be cautious with page builders and 'all in one' bundles. They add a lot of code to every page and are hard to remove later.
- Keep them updated. Weekly on an active site, with a backup first; see how often to update your website.
Plugins versus custom code
For a feature that is specific to your business, a small custom plugin written for you is often better than bending a general one to fit. It does exactly one thing, has no settings you do not need, and does not get bloated with features aimed at other customers. A good WordPress developer will tell you which features should be off-the-shelf and which should be built.