It's not really a lore issue because WPvP is non canon. It never actually happens in the game's storyline. So in lore, Malfurion isn't just standing and watching Tyrande get attacked, just as Varian isn't attacked and killed inside his own castle every so often in lore. But it's still very immersion breaking. But it's not a 'I'm so neutral that I'll watch Tyrande die' issue but a 'the devs didn't bother to give me a combat script to fight against horde players that agro Tyrande.'