CI/CD is RCE as as service. Not opening CI/CD to the public by default seems like a security necessity.
I first thought it would be easy to sandbox and have something decent running, but after making some research on sandboxing, I realize how hard it is, and the many ways bad actors can exploit a service running untrusted code.
Kudos to GitHub and GitLab for taking the challenge of providing a RCE service with a free plan.
Or we could acknowledge there is a space between complete unmanaged access and no access.
Secondly, parent comment said public by default is bad. Parent didn't say "all public was bad". So there is no necessity to make it into a disagreement.