Why doesn't Drupal hide CHANGELOG.txt?

Mainly it comes down to this:
There are two types of attacks in the web world:
- automated bots that randomly surf the web looking for known exploits.
- someone who specifically wants to exploit your site.

For the first category they don't care what software your site is running or what version, they just wallop you with everything they've got. If you review your logs you'll see bots attempting exploits for everything from phpBB to Sharepoint to Plone. Removing the files will have no effect.

For the second category they won't even check for the existence of the file. There are automated fingerprinting tools that will tell you with greater certainty what the site is running. For example:
https://addons.mozilla.org/en-US/firefox/addon/10493/
But this class of attacker knows that they are unlikely to find an exploitable vulnerability in the core CMS. Code is more likely to be vulnerable the fewer people that use it (and hence the fewer people that have audited it). This means lesser-used contrib modules, custom modules and custom themes. Specifically theme code has been historically most vulnerable. That's where an attacker will try penetration testing, and of course text files mean nothing here.