So, they hacked a default Wordpress install with no plugins updated, customized, removed or anything? Moreover, the password was easy to 'guess' because it was a well known password?
Okay, this is not _great_ out of the box, but even with mild configuration, it would mitigate this whole video.