I guess it could be useful for people who use weak passwords and I suppose just given numbers of scale that WP sites do get hacked via password. Not sure I'd call that "hacked" but more like, "oops".

Traditional hacking does not attempt go through the front door (Mathew Broderick 101 LOL).

The theory is quite simple. Find a plugin that has considerable usage which the WP site or ThemeForest etc. readily display: "Downloaded 14 quadbillionzillion times". Install it. Throw hackers tools at it and/or security penetraion prevention - ware and see what turns up.

Some of the better commercial based penetration testing software is AMAZING. They are created to attack Enterprise level applications be they Internet, Intranet, stand alone etc. They are built for industry and thus are quite adapt at what they do.

A hacker finds the flaws. They then look at source code to find a signature. Data that comes back to a browsing session. It can be as little as a exposed comment, HTML, Javascript basically using these aspects as signatures of a potential targeted site. Just as "search engine bots" identify site applications so as well can any bot. I am sure that some hacker out there made a bot that does nothing but thus a list exists of who knows how many WP, Joomla whatall installations.

Its relatively easy if a hole is discovered in some plugin to automate action against it.

Running a zillion passwords against a zillion sites most assuredly can identify sites with weak passwords. Or, WP could by code enforce string passwords. Thats not hard to do. Maybe hard to remember for a user, but not hard to do.

The general "web" concept (those automated thingies that have "Weak" or "Good" or "Excellent"
password choice are usually pretty dumb.

Instead concepts such as data pairs tend work better. AKA: Password must contain two Upper,Lower and Numeric data pairs: "wF3" and "Y2p" for example at the least or they can of course be larger. Regex wise, not real difficult to parse against.

Instead sites say, "Must have at least 1 uppercase or 2 and a numeric" etc.

Other ways include (but not limited to via automation) having a user password and partial password generated and concatenated. Simple "Enter an important date you will remember" which is then mashed by code, indexed across a datastore of buckets of 3-5 letter words and is attached.

Actually I know a way come to stink of it (errr think of it) that protecting insecure admin logins can essentially be virtually completely eliminated. Perhaps I should create that.