I see that some plugins like Wordfence can write on core folders like wp-includes or wp-admin (if write permission is en