The biggest update to Wordpress that always been missing is an ability to customize directory structure to make it harder for scripts to poll for plugins, themes, versions and whatnots.
My wordpress installs all have a custom directory structure. Core WP files are in /wp and a separate directory contains the plugins, themes and uploads folders. You can configure WP to do this, and Roots Bedrock does this for you. Not really a security feature, though. But it is nice to not have your plugins and themes in a subdirectory of WP since bedrock updates plugins and wp via composer.
