The percentage of users that need this functionality is exceptionally low. If WordPress bundled every feature that some percentage of users could ever need, we'd have the opposite problem. The GUI would be an endless mishmash of features that most people don't need.
> There's a 99% chance that site is running WordPress and has dozens of plugins and got hacked at some point
I don't know about these statistics, but I take your point. Although I'm not so sure this is as big a problem in recent years. The WordPress team has made big improvements in improving the quality of the WordPress plugin repository.
The reality is that WordPress is a big target. Even if they included all the features from the top 1000 plugins (which would cause an uproar), there would still be a huge market for plugins and some of those plugins would have security vulnerabilities.