I believe WP Core and plugins should not be viewed separately in terms of security. Plugins are omnipresent. Integrating security measures across both could create a more robust system overall.