Admin log in on site with no logins
Those pages are, by default, blocked in the Drupal generated robots.txt file meaning that it's very unlikely a "regular user" will stumble on them.

Someone would have to know you were using Drupal, and then type in that URL.  You're right though:  many people will know how to do that.

However, it's not a big deal.  Your admin account password should be strong enough that it cannot be guessed at.  Drupal is quite secure.  You have nothing to fear about leaving that login form where it is unless your passwords are really, really bad.

The amount of effort to re-create the login pages elsewhere does not make any sense in this case.