Paul Tansom said:
I thought pingbacks were disabled by default
<https://core.trac.wordpress.org/ticket/21509>
"Quite a bit has changed since we introduced off-by-default for XML-RPC.
Their code has improved, and it is no longer considered a second-class
citizen when it comes to API development, thanks to the work of a large
team of awesome contributors. Security is no greater a concern than the
rest of core.
"There is no longer a compelling reason to disable this by default. It's
time we should remove the option entirely."
Ian