global $current_user;
This is Wordpress, making it nearly impossible to clearly grasp what's going on leading to unknown amount of vulnerability at any given moment.
It's probably the dumbest code used by the mass.
Use wp_get_current_user: https://codex.wordpress.org/Function_Reference/wp_get_curren...
The largest attack surface for WP is poorly developed plugins and themes, not WordPress core.
It's bad practice to use global variables, but you somehow blame the person who highlights this use, as opposed to the project that is littered with their use.
You're criticising 'plugins and templates' that make use of the global scope, while giving the WordPress core a free-ride for not just using global scope, but placing objects there that can be exploited.