In reply to George DeLair.

@George DeLair,

"WordPress is as secure as you make it."

That's not true. It's as secure as you make it within the parameters set by WordPress itself.

I am pretty sure that @ggb's point is that the developers should be focusing on those parameters. I agree.

The recent focus on shiny stuff has got us, among other things, Distraction-Free Writing that isn't distraction free, a nauseating list of plugins every time the user goes to the Add Plugins page, and a new list of things to be removed from the Customizer: all things should have been handled by plugins, at least until there was a broad consensus as to what merited inclusion in core.

The WordPress community likes to say that WordPress is now not just a blogging platform but a CMS platform too. It would be nice to see development focusing on stuff that reinforced that claim.