I was at a conference, last May I think, where an Elastic employee presented about exactly this topic (insecure defaults in database systems). If I remember correctly, they changed it from a commercial offering to secure by default now (before that talk already I'm pretty sure).

Instead of bothering him/the rest of the audience I left it be (was probably from before his time), but yes, I was also wondering why security was part of the commercial offering...

Anyway, past be past, this is no excuse in 2019 anymore (even if I will be hesitant with Elastic Co in the future).