I feel the same way. Default setting should be secure, unsurprising and suitable for at least small-time production, and good software further guides the user t

I feel the same way. Default setting should be secure, unsurprising and suitable for at least small-time production, and good software further guides the user to use it such that they aren't likely to shoot themselves in the foot. Unfortunately, it seems quite often software defaults get optimized for developer convenience and may do insecure things like installing development-time dependencies by default... When someone goes and uses that software in production, they are very likely to end up using the bad defaults. That is not the user's fault. If you can't provide at least secure defaults, the software should not run at all until the user has made the necessary choices.