In reply to Jan Dembowski.

XML-RPC is a problem if you don’t have strong passwords.

FWIW, this is one of the reasons that the REST API doesn't (and never will) accept username/password authentication without a plugin. (The other main reason is so we don't support the give-your-password-to-everyone antipattern.)