What tends to happen is that spammers hit that file up and ask it to perform slow operations (the Wordpress team recently greatly expanded its capabilities). A PHP instance gets tied up for the duration. I've had instances lock up until killed by timeouts of 2 minutes.

When a bunch of traffic arrives at once, it only takes a handful of badly behaved instances of xmlrpc.php to render the server essentially inoperable.

I just went through this a few months ago. My bloggers don't use it and it can't be deactivated from within Wordpress any more, so I just 404 it in nginx.