Usernames are not passwords so it shouldn't matter if they're public. It's useful and elegant to be identified by a relevant slug. You can use 'admin' with a memorable diceware passphrase and it's not likely to be cracked any time in the next few decades. With a plugin like Limit Login Attempts it will never be cracked by automation.

The main issue is education. Huge masses on the Internet are still using predictable passwords. I'm shocked at some of the passwords I see in 2014. Sometimes it seems as if zero progress has been made with educating people about password security in the last decade. That's why core should limit login attempts and somehow enforce strong passwords.