Keeping this around, as a default, was a bad decision. Definitely. But really, they were screwed once it had shipped. They could and should have disabled it in

Keeping this around, as a default, was a bad decision. Definitely. But really, they were screwed once it had shipped. They could and should have disabled it in an update long ago, but then anyone who read the release notes or the code would know how to exploit the millions of un-updated systems.