It baffles me that it comes insecure by default, if that’s what’s happening. How hard can it be for a standard install to come protected with a unique password,

It baffles me that it comes insecure by default, if that’s what’s happening. How hard can it be for a standard install to come protected with a unique password, user-provided or otherwise?