Hi

Regarding the security issue I think you don’t need to hide the username, you can disable login by username and enable login by only email. Email addresses arent publicly displayed there by improving login security. I was able to achieve this with the code below.

 // Function to log in with email instead of username
function use_email_for_login($user, $username, $password) {
    if (!empty($username) && !empty($password)) {
        // Check if the entered username is an email
        if (is_email($username)) {
            // Get the user by email
            $user = get_user_by('email', $username);
            if (!$user) {
                // Email not found, return an error
                return new WP_Error('invalid_email', __('Invalid email or password.'));
            } else {
                // Authenticate the user with the retrieved username
                $username = $user->user_login;
                $user = wp_authenticate_username_password(null, $username, $password);
                if (is_wp_error($user)) {
                    // Authentication failed, return an error
                    return new WP_Error('invalid_login', __('Invalid email or password.'));
                }
            }
        } else {
            // If the entered username is not an email, return an error
            return new WP_Error('invalid_email_format', __('Invalid email or password.'));
        }
    }
    return $user;
}
add_filter('authenticate', 'use_email_for_login', 20, 3);