Oh I didn’t know you were talking about systems being used by idiot end-users who download whatever, the ultimate security hole.
A plain vanilla install of Red Hat Linux does not default to a high secure configuration. That covers the usage model for a lot of non-idiot computer users who are not themselves experts, but simply people who use computers to do their actual work. Not everyone can or should have to be a computer expert. Some people have a business to run and just need to computer to work.