Many Wordpress sites are not set up by developers or technical people. A significant number of them are set up by marketing teams just spinning them up in a cPANEL or GoDaddy or something.
IIUC those tools would usually prompt you for a username and password as part of the installation procedure, so your installation would be secure right off the bat.
That is literally the opposite of an excuse. cPanel, and any other hosting provider, has all of the tools needed to implement this correctly. The user wouldn’t even have to leave the browser.