I can't really speak for the Plex developers. But as an ecommerce developer myself, I feel confident that the answer is that best practice is always to make the default settings the configuration that maximizes security protections. If you, the user, want to back that off trading security to get more convenience, fine, but it's on you, not on me.

Installation wizards ask the configurer to set various levels of security. It's not apparent that this option should be elided from any and all installation workflows.

Dark pattern?