I would love not to have to install at first a security/firewall plugin to harden WP. I think some things could be easily integrated in core: limit login attempts, WordPress Version suppression, Error messages, protection malicious URL requests, IPs white- and blacklists, etc.