And what if the thing I'm building isn't intended for the public internet?
Then why are you building it on the public internet?
I'm not. I'm just using flask/mongodb/whatever for some internal app. But if it's secure by default I need to jump through a bunch of hoops to secure something that won't even be on the public internet.