Off the topic a little bit, but, they can secure and document all they want. WordPress will never be secure as long as any theme or plugin is allowed to run. Head on to themecheck.org. Look at some of the themes that get low scores. Look at the security breaches warnings, the malware, etc... There are still plugins with the timthumb and other dangerous scripts within plugins in the WordPress plugin repository.

As long as the WordPress core allows themes and plugins to be activated that contain dangerous scripts, security breaching codes and malware, it will NEVER be a secure platform. The whole exercise of securing the core is like a joke. It is very similar for the US government securing the airports and seaports, but very little is done to secure the borders. So very easily, anyone can walk in through Mexico or Canada. It's the same joke in a different form!