Security is essential in any site.
WP (30% of them) has an additional responsibility on that matter.

Wouldn't a core backup system resolve the big issue - breaking sites?

A "simple" rollback one. Just some snapshots of plugins, themes, WP versions in a before/after update state?
And even a way to automatically detect if the site is down, rollback and warn the developer?