A couple things I'd like to see make it into WordPress core would be user capability administration and some enhancements to login/registration security, like bot registration restriction and login attempt limitations. Those are things I think shouldn't be left to plugins, in my opinion.