Drupal ships with more accessibility than most frameworks, which makes it easy to keep a site compliant and easy to quietly break it. The threshold is not the content management system; it is the theme, the media and the forms a real person has to finish.
What the platform already carries
Skip links, landmark regions, keyboard-navigable administration, labelled form controls and alt text as a required field on images. None of that survives a theme rewrite unless somebody checks it, so the audit happens against the built page rather than the module list.
Where sites actually fail
Contrast ratios chosen because they look refined. Heading levels used for size instead of structure. Images of text, or decorative images given alt text that describes the file rather than nothing at all. Custom widgets that trap a keyboard. Autofocus and motion that cannot be turned off. All of these are decisions, and all of them can be reversed.
How we verify
Keyboard-only pass through every form, screen-reader pass through the primary task, then an automated scan for what tools can see. A tool will report maybe a third of the problems, so it is the last step and not the report a client signs.