My must-have core features, pretty much before I would actually consider opening any Flarum setup to the public would be:
Plugin installer: advertising the extendability of Flarum and then requiring people know how to work with composer isn't that extendable after all. [HIGH PRIORITY]
(Advanced) Extended links: I would have gone with oEmbed but as years have progressed, and Open Graph/Schema.org, have improved oEmbed itself has become a little bit of a dud/turd.
I think this is a core feature, and a high priority one at that, even if only for the sole reason that every IM client/app provides that functionality nowadays. Fora compete directly with social media and why would we expect the user to know bbcode, or any shortcode [media] if their preferred platform offers the functionality de facto in this day and age.
I added to the topic Advanced because I wanted to link to a Youtube video, with href tag and anchor text, and the preview automatically embedded the video. An imgur link on its own line, without HTML, showed the imgur homepage in preview, not the actual image.
I'm torn between attachments and Improved admin features and WordPress.com as additional SSO provider.
#2 Would make attachments an extension solely candidate, not required but nice to have. Not everybody knows imgur, giphy & co. but the/a core functionality to embed media would be available if extended links are core functionality.
Mass moderation (both posts and users) is IMHO a must for any moderator/admin. Just like an available and easy to integrate contact form (because DMCA and user generated content). The frustrated admin/mod doesn't want to first have to look for an extension and install these features when their board got hit by spam/trolls/whatever.
Lastly, I don't anything WordPress should be core but it just happens that many WP users aren't truly satisfied with their platform and integrating WP (and also Gravatar) early on in core will IMHO help in later stages, and possibly also with Flarum's future success/popularity. To be honest, I would totally expect Gravatar as a default avatar provider in this day and age.
Components such as PM, front-end tags, even 'following but without notifications' are IMHO all extensions. OK, maybe the latter could be more of a core functionality (haven't checked the API whether it can be built as an extension but I think it is the best following state of all four - sorry, sometimes I have to work, doesn't mean I don't want to follow but email noise is not helping).
It's the trap WP has fallen in actually, and so have many other OSS platforms. Core or bloat? Is it truly required a function to be totally user-friendly, or is it a wish of some/many/webmaster. Does the UX suffer without it or doesn't?