I don't think it's so much Wordpress, and moreso the demands from customers to make their lives easier, so hosting companies did exactly that. They accommodated the market, and you can't blame them for doing so. People want to pay $14.95/month for a hosting package with 50 domains, cPanel access, one-click WP install, have one-click WP Plugin install within WP admin panel, access to phpMyAdmin, no IP restrictions or SSH keys, and all that shit. Not to mention, then people save their server passwords on things like Google Docs or Dropbox.
I'm sorry, but what a security cluster fuck that is. Just cPanel based sites are insecure in and of themselves, because they're open to file injection. Might be more convenient for you the end-user, but by no means secure.
If your sites are making that kind of money, then don't skimp, drop a couple thousand into proper security with a server admin hardening everything for you, and just smile & nod at the inconveniences your server admin provides for you, because he's doing it in your best interest.