Why is Microsoft's implementation a problem? Having the setting default to a safe value is the rational choice.

It's like saying having a secure OS/browser would deprive malware authors of revenue, and thus vulnerabilities should be preserved unless the user explicitly opts into patching them.