Re Elasticsearch. It used to be much worse.
Even basic authentication was only available to those with an xpack subscription, it didnt have any security unless you paid money or used Nginx or another server to apply the auth and proxy the connection.
That didn't stop people from making instances available publicly, and it was only until Elasticsearch started hitting the news about all the open instances did they make it available in the free tier from May 2019 (6.8.0 / 7.1.0)