The big takeaway here is that you simply should not use any technology on an internet facing server that you are not 100% committed to. There is no such thing as a 'casual' SaaS, you either dedicate the time and the effort required to intimately familiarize yourself with the crappy little details of all the tools you are using as well as their caveats or you will end up getting hacked.
That said, software suppliers have a serious responsibility to choose sane defaults, especially for security related items. If that inconveniences the users to the point where they have to explicitly overrule the safe settings and that reduces adoption then so be it, that's a small price to pay. Failure to do so will make those suppliers accomplices in all future hacks due to their lack of respect for reality: the internet is a hostile place and anything that can end up facing the unfiltered net will eventually do just that.
Finally, we will eventually end up with a regulated internet because of all these script kiddies and other wannabe hackers, where just like in the real world you'll need a permit to operate a server, mandatory pentests and so on.
The likes of AWS already make it a bit harder to expose an insecure server to the net by checking for common configuration errors such as the one that caused this particular failure.