Re: It is appalling
My experience from a Wordpress specific host is they will implement a change of login url, username and install a rate limit login at the time of install or in our case migration.
This should hopefully mean anyone who has never had a website before can be more secure from the get go without needing to know how to change these!