Insecurity is the default in Java as well.

I'd be curious to know the history too. Did they really not forsee that external entities are a security hole?