I can well understand why so many use the default settings, after all how many know much more than how to switch on their PC. An awful lot of smaller firms won't have IT trained staff. Bigger firms just get lazy.
Even so, enabling wifi security is not that straightforward. Spent tow hours last night trying to get a wireless bridge to work with my existing network, all because some of the security settings set up on the access point weren't accessible on the same manufacturer's bridge