I knew I had the right person for this... thank you for the reply, and thank you for being nice, I was expecting a drone outside my window to be honest...

You make a very valid point, regarding the arms race. But isn't it better to have even an arms race, over doing nothing? Then why bother about patching the core? Every time we get an update, 2-3 weeks later, we get a sub-version, that has bug fixes, and security fixes. Isn't that an arms race? In a real life analogy, what good is it to secure the airports and the ports, when people can simply drive through the borders?

As far as solutions go, how about for starters, making the Plugin Inspector, and the theme check plugin as feature plugins (so merge them with the core), and at the very least warn the site admins that a certain plugin or a theme is not safe, when trying to get activated. The only ways to bypass this and beat the system would be actually to hack the core, or the server, unless the site admin activates an unsafe theme or plugin despite the warnings. And as an added bonus, plugin and theme developers will have to start coding the right way, (to avoid the warnings) - the WordPress way. I have one thousandth of your expertise and I have no idea what type of technical limitations you might encounter, but isn't this important enough to at least think about this, over distraction free writing, and the syntax of shortcodes? Am I the only one who thinks this way?

I mean no disrespect, I am just very passionate about security...