iframe forms into Wordpress?

This chart was never correct.  Using embed code allows you to hide the form if the visitor is known and can be used in the fills out form trigger/filter.  Prefill is not available for embed code though, and neither are conversion stats from the landing page performance report.

Prefill is a pretty major feature requirement for forms IMO

For some, yes. In many cases, for legal reasons, it's strictly forbidden, so it isn't missed!

Nevertheless since last August I've been mentioning that I developed a cool workaround, which I even demoed at our local MUG.  Almost no one has pinged me back to show interest. This leads me to think it isn't really as major as it seems (I've responded on threads that were opened to complain about it and the OP hasn't contacted me!).

I'm sure people underestimate the inherent security risks (which my workaround doesn't share) if embedded forms were only tweaked to enable prefill (as in: that's the only change made to the code).  Let's see how awesome that would be for the owner of Malice, Inc:

• add YourCo's Munchkin code, generating a fresh 1st-party cookie
• get the lead's email address with a friendly form
• post the form to YourCo's Marketo instance, associating the cookie
• embed one of YourCo's forms, hidden of course, and grab any prefilled fields
• post the prefilled fields to Malice's db

Granted, this process can be simulated now with the assistance of server-side code (which is kind of why prefill makes me feel icky even now).  But being able to do this solely client-side makes this abuse much harder to catch.  You're essentially having leads hack themselves: all the actions are originating from the lead's machine, as opposed to from an intermediate server.  Of course there's still a server out there collecting the data, but that could be just putting stuff on a DMCA-protected Pastebin type site.

So you need to do more than simply letting lead data flow offsite, you need measures like origin verification against a user-maintained list of allowed domains (the same thing that could be done with Munchkin, but hasn't yet).

But before "prefill everywhere," what I'd rather have is the option for more secure self-service.  A passcode -- maybe just a 4-digit PIN, we don't need to approach this with ultimate seriousness, and anything is better than nothing -- required for reads and writes, and email confirmation before a lead is activated.  I know for most marketers this would seem punitive, but I also come from the financial sector where even salespeople get creeped out by unauthenticated self-service. The counterargument is made that if the data is considered updateable by the lead, by definition it isn't a corporate secret.  That's true: if I let somebody view and modify "their" age and annual income, it's not like I'm leaking the lead scoring that goes along with that.  But unless you make sure that you never prefill any PII, you're leaking a combination of data that a lot of malicious people would loooove to get their hands on.