In reply to Peter Knight.

I agree with you and also with others who say code integrity or version control is important. Personally, I always turn it off.

Yes, administrator by definition has the highest privileges to do anything. But consider a scenario when some minor plugin has a XSS vulnerability and it is used to place backdoors (demonstrated here https://ibreak.software/xss-to-rce-using-wordpress-as-an-example/).

Yes using XSS, attackers could just steal admin's session and upload a plugin of their own anyway. But it's the convenience of WP code editor which makes it easier to place stealthy backdoors. Much easier to scale and automate attacks in my opinion.