Arch doesn't market itself as a newbie-friendly opinionated secure-by-default distro.
An Arch package having less-than-ideal default settings is pretty normal: the user is expected to read the manpages and the Arch wiki when making any alterations to their system. They guide you towards making it secure, but if you want to leave it insecure because of reasons then Arch isn't going to stop you from shooting your own foot.
An Arch package having less-than-ideal default settings is pretty normal: the user is expected to read the manpages and the Arch wiki when making any alterations to their system. They guide you towards making it secure, but if you want to leave it insecure because of reasons then Arch isn't going to stop you from shooting your own foot.