This seems like an intentional oversimplification. Having mass-assignment on by default and therefore requiring the developer to create a whitelist of attribute

This seems like an intentional oversimplification. Having mass-assignment on by default and therefore requiring the developer to create a whitelist of attributes for each of their models has a complexity cost associated with it. Failing to mention this at all shows a lack of objectivity. I happen to believe it's worth it for the increased security, however I'm not going to pretend that there isn't an associated cost.