As always I think the answer is in the middle. You can't have a piece of software that defaults to insecure and expect everyone to have the common sense and ski

As always I think the answer is in the middle. You can't have a piece of software that defaults to insecure and expect everyone to have the common sense and skill to secure it. You rarely can release a piece of software with hard security defaults and expect it to have enough usability to gain critical mass / adoption / be popular. I remember when I first learned web development and I absolutely had a belief that the defaults would protect me from royally fucking up. Postgres security defaults for example. And although this is obviously not true in reality, we can't let ourselves overlook it just because.