This has been discussed since the early days of Rails, and they have chosen to leave their defaults as such and encourage developers to implement model security

This has been discussed since the early days of Rails, and they have chosen to leave their defaults as such and encourage developers to implement model security as needed. Github (seemingly) did not implement model security. This is a vulnerability that is different from application to application, and if the team was following best practices, is not there.