In reply to David Artiss.

and working on one obviously prevents from working on others?

wordpress.org was since inception of the update mechanism a weak security point. It is actually amassing that as far as we know it wasn't abused in any major way, but the weakness was known forever. All other software distribution shop verify that whatever is being installed was properly signed, and this was done by the likes of microsoft from before wordpress.org distribution had started, so it is by no means a new idea that the wordpress world suddenly gets to be aware of.

But you are right that there are more important low hanging fruit that might be worth handling first, like stopping user enumeration, preventing brute force attacks, disable external "posts" via comments, pingbacks, xml-rpc, rest api, and hardening the default htaccess. But wait actually no one works on any of those things, so what exactly is higher priority?

No one that has been around wordpress for long enough time has any illusion about what is the highest priority of core - market share. Anything else is handled just in the minimal amount of effort that is required for the market share campaign to proceed.

Core in general do not care about security, or software quality (two things that go together many times), and this is the reality everybody that works and uses wordpress accepts, which is why security related plugins are among the most downloaded ones. If core was secure no one would have needed them.