Drupal should not let the web server write to code directories
True confession time: several years ago I had a few WordPress sites. I didn't update them for months and they got hacked. Someone uploaded a PHP shell to the server and they also were able to redirect search engine traffic. To me, it looked like the site was normal. However, when a visitor came from a search engine, they were redirected to the attacker's site. They took advantage of yet another flaw in WordPress.
Now, some people affiliated with Acquia and other companies are keen on bringing that experience to Drupal.