The acp is vulnerable to brute forcing password attempts the way it is.... This way a hacker can make significantly less attempts to crack a password. So even if your admincp directory "gets leaked" if you've changed it, anyone trying to bruteforce it, won't be as effective.