> WP has the ability to use (S)FTP to update the files rather than direct file access.

Well that doesn't help at all with security.