I don't get it. Why not take 30 seconds to make it exponentially more difficult for a determined bot to hack your site?

Granted, if your user name is well known, then it will be assumed that it's your login name. But that's irrelevant. Because if your actual WordPress login name is dX5A!w3Qfr2p and your NICKNAME is Yoast, and you've hidden/denied access to your author archives, you've just increased your security significantly by adding a secure admin name.

To not do this is like not taking a few seconds to turn your home security system on because you already have a guard dog, or because burglars don't break in through the front door that often.