That's a pretty bad round of dropping the ball... Normally I respect that OWS explains security stuff in detail if you care, but also has a product that "just works" if you use defaults without much knowledge. This is pretty much the exact opposite of that, where they released a dangerous default with minimal explanation even for people who do read their stuff.