I agree. Usernames are only really susceptible to brute force attacks and these attacks rarely target usernames anyway. I run stats on multiple different blogs to see different attack vectors and they are usually centered around the "admin" username or some variety. Only rarely do I see the actual usernames on the site used in an attack.

We take three steps to curb this kind of attack:

1. Force strong passwords
2. Limit Login Attempts plugin or similar
3. Google Authenticator two-factor authentication when required

These three make it pretty much impossible to unlock an admin account through brute force or other vectors and leaves us to focus on other more sinister ways of hacking or attacking a site.

There is a valid question to be asked about whether limiting login attempts should be built into WordPress as a core feature, but that might be a different conversation.