@Steven -

All that security is going to do little good for anyone who has both nefarious intent and access inside the server, especially if that server is mis-configured (as with the Network Solutions hack).

WordPress, out of the box, is pretty darn secure. There are other things that can be done to harden a WordPress install, but they are hard to build in or to automate during/after install, because they are things that are outside the control of the application.

Other things (.htaccess rules that block web access to wp-config, wp- files and folders, etc.) could be implemented (e.g. in the same way that pretty permalink .htaccess rules are added), provided that servers are configured properly.

Some things, though, just require an awareness and understanding that running one's own web server and web applications requires a certain level of knowledge and effort to safeguard against attacks.