In reply to M.

@Rick,
I just don't use FTP, be it SFTP, FTPS or whatever other variant of it.

Also, I have two kinds of projects. Those which are critical and those which are less. The first kind needs a whole set of measures and reviews before pushing anything live and most (potentially) dangerous features of WordPress are disabled on that. The other kind is less critical and there is less bureaucracy with it.

And my point here is that most of WordPress users use it for the second kind of projects, otherwise, WordPress wouldn't have this much marketshare. And this kind of projects gains from having WordPress easy to use by keeping the bureaucracy to the minimum necessary.

Apart from this, I will not discuss my security measures any further on this comment thread, I brought this just as an example and I don't feel like explaining all the logic and reasons behind them.