WordPress has security plugins. So where are the safety tools?

Most WordPress sites are "secure". Firewalls are active. Updates are running. Login protection is in...