Moreover...

If an attacker identifies a vulnerable server with large numbers of users, he can just do a username enumeration, and try them all. It then doesn't really matter whether the percentage of requests that will generate usable bounce-backs is large or small; he only wants one to succeed.

On PHP versions, the WP developer team's view is that WP should/cannot bump up the minimum PHP version from 5.2, and/or should not display a notice urging the user to ask their host to upgrade, because users don't know about or understand these things, and it's unhelpful to display something potentially confusing. Compare that with the WP security team's view, on this issue, that if you are vulnerable to the issue, then you're at fault because your server is badly configured, and, you shouldn't be expecting the WP security team to prioritise a fix because of that. These two viewpoints are contrary.