If you're unfamiliar with the nuances of good development practices or basic security, this is an obvious thing to do. It lets you iterate and work on it until you're ready.

It doesn't even occur to a lot of people that this might be a bad idea. Salespeople, marketing, a sole prop, or someone who wants to set up a blog are all people who would have absolutely no idea how to do this right... and no clue that they're doing it wrong.

Same here. It is trivial to keep it on a private network or behind an SSH tunnel or a SOCKS proxy or _anything_ that limits access to just yourself until it is actually ready for random visitors.

I agree, Step 1 for me has always been to add a rule to the firewall to block all connections except from my IP while I work on it.