Enabling functionality by default makes it available to people on initial installation. From a convenience perspective, it seemed a plausible choice. It took

Enabling functionality by default makes it available to people on initial installation. From a convenience perspective, it seemed a plausible choice. It took some effort to get people at Microsoft to start seeing things from a security perspective. The work Michael Howard (who wrote the "10 years since the BillG memo" article 'twoodfin linked to below), Jeannette Wing, and I did on measuring attack surfaces was part of this -- trying to quantify, even roughly, how big the attack surface was so that there could be explicit goals to reduce it. You're certainly right, though, OpenBSD was way ahead of their time here.