In reply to Matt Mullenweg.

I am genuinely curious as to why all the work on putting Gutenberg into core was considered a higher priority than stopping the situation where an 'out of the box' installation of WordPress will..

.. allow attackers to try as many username / password combinations as they like without doing anything whatsoever to slow them down or stop them;

.. give the attackers a mechanism - an xml-rpc call with no legitimate use - that enables them to try hundreds of combos at once;

.. allow people with accounts on a site to have a password of any strength they like, with nothing that the site administrators can do to enforce a minimum strength;

.. etc etc etc.