This is the real problem, Wordpress doesn't care about security. Why can a bad plugin own your entire site? Why aren't half the security options for xss protect

This is the real problem, Wordpress doesn't care about security. Why can a bad plugin own your entire site? Why aren't half the security options for xss protection available, let alone built in. Seems impossible to automatically add hashes for 3rd party code, not use inline css, etc