The Wordpress project people have more often than not prioritized "ease" over security. This is no different. Should there obviously be a unique, temporary pas

The Wordpress project people have more often than not prioritized "ease" over security. This is no different. Should there obviously be a unique, temporary password encoded in the wp-config.php that prevents this? Of course. Would it diminish "ease"? Yes, and therefore it won't happen. They're deathly afraid of making anything more difficult to the lowest common denominator, and, by extension, the scammers of the world.