Because the defaults are bad, vendors have the ability to ship products that are insecure but will still work on a default / typical network.

Administrators have to make risky changes with complex monitoring systems in place to tighten the security to a reasonable level.

The larger the network the harder this is, to the point where it becomes impossible because there are too many incompatible devices.

This is the criticism of the protocol: it not only leads to a pit of failure from which each customer has to dig their own way out.