In reply to Charlie Merland.

In reality, it is exactly the other way around. To have the feature working you need the webserver to be able to write to your code directories which is against web security good practices. It is also not very easy to set the correct directory permission if you are not familiar with the linux file permissions model which is way above the heads of the avarage wordpress user.

And while defacements suck, most of those sites that have their file permissions set in a secure way, will be abale to avoid the most obvious remote executions attacks that are being attempted now.

The right solution (if you are one of those that never heard how 4.7.1 broke sites, and therefor happy to install whatever software without checking it first) is to have the hosting companyhave some script of their own to do that which will run as a root user, eliminating all the permission complexities. I know siteground do that, probably other big hosters as well, but smaller ones might not even know that there is an issue that needs to be resolved.