I assume that's the case. Securing mongodb isn't rocket science, it's not all that different from any other database, so I can't imagine a business with any value has unsecured mongodb instances.

What I mean is, it's pretty ignorant that just because authentication isn't on by default you don't turn it on at all.

Even if you don't want to or don't think to configure mongodb itself setting up a firewall also seems to be common sense.

Thus, the only reason they'd be unsecured is they're either for random tests or hobby.