I am going to blame Microsoft, because “works out of the box” shouldn’t conflict with “secure out of the box.”

And while I won’t blame Linus for insecure-by-default Linux configs, I will blame whoever integrated the distro/dockerfile/etc.