I doubt it's still the case but for a long time the default "Authorization" was effectively fail-open so a newbie mistake was to use that and then not customize

I doubt it's still the case but for a long time the default "Authorization" was effectively fail-open so a newbie mistake was to use that and then not customize it leaving your API vulnerable to any logged in user reading anything. There was a bright red box effectively saying "Don't use this module without customizing it" in the documentation but that didn't stop newbies going live with it in place.