AWS Elasticsearch is closed by default. You have to upload access policy first in order to access it. That port was open during configuration. You can use aws iam, cognito and sg in order to control access to ES instance.
If you click things together yes. However, most of the real world uses infrastructure as code type approaches involving things like terraform, cloudformation, etc. They give you plenty of ways to mess that up. Running unsecured should not be an option period. It's for sure not an option on elastic cloud.
I don't really like AWS ElasticSearch offering (it's subpar at the very least and I'm being kind) but what you are saying is completely unfair. If I'm using IaC then I'm a power-user and I want to be able to open an ES cluster to the Internet if that makes sense to me. What should be protected by default is the point-and-click wizard configuration (which it is, indeed).