There is a weird dynamic going on where defaults have become "good enough": ssh with public key configured and password auth disabled, services defaulting to on

There is a weird dynamic going on where defaults have become "good enough": ssh with public key configured and password auth disabled, services defaulting to only listening on localhost, etc., but those improvements have also cause people to pay much less attention to server hardening or to checking if any of their services might have unsafe defaults. The world is made much better by safer defaults, but they also lead to a degree of complacency.