I'll take a guess and say it's because it's not possible to magically generate that code. If I wrote a code generator, there's no way that program could know wh

I'll take a guess and say it's because it's not possible to magically generate that code. If I wrote a code generator, there's no way that program could know which attributes should be accessible. The only way to get a scaffold to work out of the box is to require some user configuration or allow all attributes to be modifiable. It's a case of ease-of-use trumping security.