I have WPScan 1:2.9.2-3 on Parabola (though this issue seems present in Arch, too).

Simply put, WPScan needs Metasploit for some features, such as user enumeration. However, Metasploit is not marked as an optional dependency, despite it being needed for these features.

It's important to note, though, that enumeration is not enabled by default, so not having Metasploit does not substantially affect the usability of the package, hence why it should be an optional dep.