When clients ask me to use Wordpress for an e-commerce site, I not only say no, I say hell no. Wordpress is not a scalable solution with a myriad of other issues. Let me list the issues I have with Wordpress as an ecommerce store.
Security, it is just not secure. Most ecommerce applications use a two authentication system, not to be confused with a two factor authentication system. Like Prestashop what it does is has a login for the admins and a separate login for the customers. They are not handled by the same code, the same page, or the same system. Wordpress uses only one system, so where an admin would login, so would a client. This is insecure in so many ways in my mind. One, how many password attempts do you wait before you lock someone out? It could be a legitimate user that gets locked out costing you a sale. But at the same time, if you do not lock them out, they can write a script that for days uses different ip addresses to try to crack your admin password. On ecommerce systems most allow you to select an admin directory. Wordpress's is site.com/wp-login. Prestashop or Magento it could be site.com/3490834admin or what ever you feel like using.
Another issue is features. There really are not many, sure there are plugins that are developed by God knows who, but Wordpress was never meant to be an ecommerce platform so it lacks a lot of the valuable features. Most Prestashop sites I work on (I keep using Prestashop not to push it, but it is really the only platform I develop with) only use 2 -4 modules that are not part of the package. Usually they are like an obscure payment gateway, a module that connect to quickbooks, or a shipping module. Stats, products, features, cms, it is all held internally by the application. When it takes 30 modules by 30 different people to make a site, it will be insecure, there are no two ways about it. Something will also conflist as well breaking something. Plus there are not modules for half the features a real ecommerce platform has available for Wordpress. Sure you can sell, can you send time follow emails with coupons? Can you handle shipping products separately from different suppliers? Can you handle warehousing and storing supplier information? Can you import csv files from your suppliers automatically on schedule? It is the things like that when someone opens a shop, they do not take into account. It is a lot easier to flip a switch in the back office of a program to enable a feature than it is to either program it or try to find a module that does it.
The whole idea of Wordpress is insecure when it comes to ecommerce systems. I mentioned the login above, but it is actually the whole foundation of Wordpress. One thing that you will never catch a dedicated ecommerce system doing is executing a server side language in the template. Wordpress's templates are built around PHP with adds another layer of in security. With Prestashop, a template uses variables that are passed from the controller or the module. That way the internal MVC structure is used to execute all of the code. I can only image how upsetting it must be to someone using Wordpress to find out their site was compromised because they downloaded a mailchimp plugin made by coder dude99 and he didn't sanitize the email input. Everything in an ecommerce system is handled through the controller logic, people aren't willy nilly writing code and executing it.
Speed is also an issue, that comes in with the coding quality standards mentioned above. When you are executing all kinds of code, there could be a bottle neck anywhere. Most ecommerce platforms have built in functions for everything code wise and only allow you to use them. Want to access the database? Sure there is a function for that that checks the data for exploits before it is run. One thing I really like about Prestashop that wordpress does not do is how it handles css and javascript. When a module is developed, it has a directory it needs to be in, inside the module. Prestashop then takes the css and js and compiles it into 2 repective files, cutting down your request number and minifying it in the process. Plus it has default support for things such as APC, MEMcache, and CDN servers.
To answer your question above, yes buying a template might be all you need. It really comes down to how you want your business to operate. There is pretty wide payment gateway support standard, but there are some that are not supported. So you might have to buy a payment module.
If you are building this for a client, I would think twice about taking the job, if you don't have any experience with some of this stuff it can be difficult.