I find that using Limit Login Attempts (http://wordpress.org/plugins/limit-login-attempts/) really helps with brute force attacks. I also use some of the other plugins that have already been mentioned. I'm pretty satisfied with the level of security it brings me. The only time I've had a security problem in the past year, or so, has been due to files being compromised via a theme, and I'm not sure if that was due to a security breach at my ISP or me downloading a bad update from a non-sanctioned repository. (But, I'm pretty sure it was a server-side issue at my ISP) And even then, that was detected by the AntiVirus plugin (http://wordpress.org/plugins/antivirus/), so I could clean up the problem.

The real "problem" is that WordPress has a large installed base, so it's a good target for automated attacks. It's a standard attack pattern with a high potential yield for attackers. Security is not an absolute and there is no absolute solution. Security is a process that we must faithfully execute on a regular basis. And, that is true no matter what the system.