I agree that "secure by default" should be, well, the default.

I envy OpenBSD's way of delivering a secure system out-of-the-box, instead of everyone else's "pretty much secure but...".