I don’t think it would’ve been an issue if they just put a warning in the getting started section in the docs (or if they just have secure defaults to begin with). But currently there’s no mention of it. It took almost a year for me to realise that I was running “production ready code” in root