Wordpress User only to access CiviCRM
I find the plugin User Role Editor Pro to be very helpful with this. https://www.role-editor.com/  This makes it easier to setup the access control on the WP side.
Use CiviCRM > administer > Users &amp; Permissions > Permissions (Access Control) > WordPress Access Control to control what parts of Civi different roles have access to.
I would NOT give Subscribers full access to Civi or WP. This is the role your basic donor is likely assigned. Yes this would create a serious security and liability issue if you give donors full access to Civi. Create/use another role besides Subscriber for anyone that needs some level of access beyond their donor dashboard.
Helpful tip. Create a user that is not your admin. Assign this user whatever role you are wanting setup with limited access. Login with one browser or computer as admin and in another browser or computer as the new user. Start editing Civi or WP Access Control settings as the admin, then refresh your other user tab and see what has changed.