The first thing I do when I install WordPress is to add the following to wp-config.php:

define('DISALLOW_FILE_EDIT', true);

It's sad that a dangerous feature like this is not removed from core altogether but "improved" and encouraged to be used, just because that's how some core dev learnt to code in WordPress.