Because the end user aren't computer scientists. End users should have NO capability in determining their own security, since they could LITERALLY BE infants playing with the iPad.
It is the responsibility of the systems designer to make sure the system is secure, not the end user.
And if you require instructions on how to secure your system, then you have already failed. A properly designed system is secure with zero knowledge.
Remember, it takes work to learn anything, and the goal of a tool is to reduce work, not to increase it.
Throw away customization. Throw away configuration. Both of those are bad design principles.
At some point you need to accept that there are sufficient hoops necessary to jump through to disable security that no one would accidentally do it. If you really think that security is so paramount that no level of compromise is acceptable, then
you should be outraged that devs can test their apps on their iPhones.
You should be up in arms at the existence of the App Store that lets you install software written by third parties.
You should be petitioning Apple to remove safari as what could be more insecure that downloading and running arbitrary code from a completely unknown website?
And you should be happy paying $1500 for a function-less, featureless, slab of Titanium with an Apple logo etched on the back, secure in the knowledge that it has no security vulnerabilities whatsoever.
You do understand that “make it work by default” and “customization” are not exclusive, right? you can definitively pick defaults and allow customization for those who want it.
It is the responsibility of the systems designer to make sure the system is secure, not the end user.
And if you require instructions on how to secure your system, then you have already failed. A properly designed system is secure with zero knowledge.
Remember, it takes work to learn anything, and the goal of a tool is to reduce work, not to increase it.
Throw away customization. Throw away configuration. Both of those are bad design principles.
Make it work by default.