In reply to Nick.

I feel like it would be practically impossible for core alone to look through source-code of plugins and themes to pin-point specific security holes. Hackers are clever in that they can obfuscate code or just hide it in plain site as a "feature". The amount of false-positives would be astronomical which would cause aggravated users and an unfriendly end experience.

While that plugin you listed is nice it also seems fairly generic in what it looks for. Maybe the best thing is does it checks against WPScan Vulnerability Database but that looks for already known vulnerabilities which, even if added to core, who knows how many websites would be infected before the vulnerability is reported to the WPSV DB.

I'm by no means a security expert but it sounds impractical to implement a lightweight be-all and end-all security fix solution to core.