Good writeup, thanks Justin.
Also worth a read from WF:

https://www.wordfence.com/blog/2020/12/wordpress-5-6-introduces-a-new-risk-to-your-site-what-to-do/