Top items?

Comment control - comments really need to have an option of "no comments on this site at all", this is particularly relevant to corporate information websites or to bloggers who do not directly invite comments on their postings (sending discussion instead to twitter or facebook, example). This really should include disabling all of the comment direct methods for posting comments, possibly using htaccess to kill access to things like wp-comment.

Inactive plug ins and themes access restrictions - Via htaccess or similar, make it so that plugins and themes which are not active on a site are blocked or diabled so that they cannot be accessed directly. This would take away the incentive for script kiddies to scan wordpress sites looking for exploits in old themes and such.

Treating tool as plugins - There are often packages which are used in themes and plug ins, such as sliders, which may appears numerous times on sites. These things seems particularly prone to security issues, and moreover, because they appear repeatedly they require that all themes using them are spotting and fixed. These code libraries really should be moved out of the theme packages and turned into "required service code" and treated similarly to a plug in. In this manner, if a slider has a security problem, then you need a SINGLE update to fix it, rather than having to try to figure out where it was used.

Login restriction by IP / Country - in an attempt to lower the brute force access attempts and to better secure installations, I think that IP / country restrictions on logging into Wp should be part of the admin panel, or perhaps set in wp-config. Most WP sites are single admin or single source admin (everyone in a given office or workplace, example), and making it so they are the only ones who can log in would be a big move to secure WP sites.

Fuller support for Cloudflare and similar services - Many of the answers I get to tech questions are "block them in htacecss". Yet, if you use cloudflare or similar caching services, blocking things in htaccess is just not possible as most users arrive from a small list of IPs as a sort of proxy. Cloudflare server tools do allow you to read in php the actual user address and country code, but there is no current support in WP to allow that data to be used throughout wordpress (ie, comment IP address, IP address for accessing the site, etc).

Access logging - Simple access log to allow you to see the IP address, date and time, and other information related to every successful login to your WP site.

Can you tell that I am all about securing stuff? On an average day I see tens to hundreds of thousands of attempts to log in to or spam wordpress sites that I maintain. The current options are not flexible enough to handle sites that don't have any comments, have a single administrator, have a single source of updates, and so on. The nature of WP is open to everyone, but that does seem to create some headaches.