Can somebody explain why this is a Rails bug? Insecure by default. Microsoft used to be the laughing stock because the default install was vulnerable to exploi

Can somebody explain why this is a Rails bug? Insecure by default. Microsoft used to be the laughing stock because the default install was vulnerable to exploits. While one might argue that Github devs should have known better, the counterargument is that if Github devs couldn't get it right, think about the thousands of people trying out rails for the first time, building their little web app.