Just adding my 2c, that Toms suggestion of WordFence is spot on!
And it’s not the themes responsibility to provide security.
There are some plugin s to change the wp-admin URL for logging in, but some mess up WordFence.
Read up on some articles that cover WordPress security, there are many!
HTH, Dave