"They assume" is probably too much credit IMO. It was the mid-2000s, no one knew what they were doing, least of all the WP core team (the security holes show that), so they made a product with a design that no longer make sense, but it's hard to evolve away from.