WordPress itself is not the issue...it is the people who own the websites.

1) People have weak usernames/passwords. There shouldn't be admin as username, the domain, the author's name (wptavern, jeffchandler, sarahgooding and so forth)
2) Weak passwords, go to a password generator and pick an 18 character password
3) Bad coding practices for themes/plugins from sources outside WP directory. Like Googling FREE THEMES.
4) Not updating. People should spend 15 minutes a day, or on a weekly basis and log in into their site(s) and check if any updates.

I am against auto-updates, One of JetPack's modules broke my site, yes I put a thread on the forums at WP.

WordPress should at the core make it easy to change /wp-admin and /wp-login.php to something else. I know I can download a security plugin (I used it, I can't remember the name of it right now)

That security plugin I can change the login url and the wp_ prefix. That and changing /wp-admin should be part of WP Core.