In conclusion, yes, I believe if something is in a common list of things that people (who are not security experts) should do to make their system more secure a

In conclusion, yes, I believe if something is in a common list of things that people (who are not security experts) should do to make their system more secure and the developer of that system refuses to make that the default, then "God, that developer is so stupid" is a reasonable response. I wouldn't blame most people for not changing this setting. Except air-gapped systems should be setup by security experts, so stupidity all 'round.