I think it was a terrible decision to have no authentication as default from the MongoDB people, but it was literally one of the first things the documentation made clear. And even without documentation, just setting up the connection should be hint enough that you need to set a password.

The blame lies only on those who set up an unsecured MongoDB in an production environment.