I once copied the wordpress files onto a new domain and a few minutes later a bot had already accessed /wp-admin/install.php and it helpfully installed the site for me using a database of their own to get RCE.