Rate-limiting login attempts out-of-the-box is something Wordpress should have included a LONG time ago. Maybe 1% of installs will setup the plugin to do this. No idea why they haven't added this yet.
Having a default username in the first place is incredibly poor practice. So many users stick to 'admin', making it just a case of guessing the password.
And don't get me started on that bloody "the loop" finite state machine. I mean, really?
Every time I duck under the hood to debug something I always come away stunned and disturbed by the frequent use of globals, the frequent interleaving of different concerns and basically the all-round untraceability of the design as soon as themes or plugins are added. It's horrid.
Oh! And there are still no unit or functional tests. And no concept of release management (such as having security patches released independently of feature patches), which is why every Wordpress administrator gets to play their favourite game when there's a new release: continue with known-security-flaw code, or install code that might just blow away your data?
Place yer bets, place yer beeeets!
WP is a good platform that does a lot out of the box (performance could use some work too though), so I don't think we should throw the baby out with the bathwater. There's just some housekeeping that needs to be taken care of beforehand.
The alternative, of course, is building something custom with the bare minimum of necessities server-side and scrubbing all input/global vars. A lot of flexibility can still be retained by implementing a taxonomy system that define what posts can be (which is pretty much a very loose Entity-Attribute-Value model).
With over 200k different botnet controlled machines, all that tracking the IP sources would do here is create massive blocklists. There's already evidance growing that the botnet is trying 2-3 passwords per source IP - effectively bypassing existing limiting plugins.
A solution to the above is to limit the logins per account per timeframe, but that just locks the legitimate users out, causes the botnet to spread out the attack over longer periods, and ultimately only has a negitive affect for the user.
The Hosts are feeling the pain though, i've seen some hosts are disabling access to wp-login.php entirely, this tells me that the shared hosts are having resource issues, so a limit-login style plugin would do zero to help them, it'd still cause massive problems for the host.
WordPres, Joomla, and other smaller CMS's are being targetted here, so this is by no means just WordPress's problem either.