The problem here is not "how to have a secure configuration", it's really "why is it not secure by default"; we actually need more "secure by default" because i

The problem here is not "how to have a secure configuration", it's really "why is it not secure by default"; we actually need more "secure by default" because it largely reduces the chances of doing it wrong.