Why would someone use function_exists(‘add_action’) in a plugin?

As you understand correctly, this is a way to ensure the file is included from wordpress core and it is not accessed directly.

1. Most wordpress installations do not prevent a direct access to any file, therefor his check is needed to prevent bad actors from exploiting know weakness in a specific file’s code.

2. Yes we do. To be fair to core, if you follow the coding standards of “php file inclusion should either have side effects or have only declaration and implementation of functions and classes, never both” (I am probably misquoting) and you have the tools to enforce it, the amount of code that needs such a protection is much lower. Still I also consider it a weak security practice by core.

Notes:

1. I prefer to check against the existance of ABSPATH which means that wp-config.php was included and therefor the file in question can be included early before add_action is declared, although in practice there is probably zero difference.
2. Don’t use exit this IIRC will make the webserver return HTTP code 200 and the page might be cached by search engines which might be annoying, use die(403) instead.