Yep, this is my experience as well. I have accounts get compromised because of a weak password. (maybe 2fa will help) But also, accounts can be locked down to I

Yep, this is my experience as well. I have accounts get compromised because of a weak password. (maybe 2fa will help) But also, accounts can be locked down to IP address (harder to manage but helps more) But does WP allow php executable on user upload directories by default? I know this is more of a server setting, but it would make sense to test for this in WP admin and alert the user.