When wireless routers first came out almost none of them defaulted to having security. Unless you were fairly technical minded, you simply left the defaults in place. Not because you were clueless, but because you trusted that the manufacturer must know what they are doing...and you certainly don't.
Now they all come with security enabled, plus, users have been educated as to why they should use it. They don't need to know how it works-just why it is important and what it means to them.
Same thing goes for enabling HTTPS on websites, adding two-factor auth to your email, having unique passwords on different sites, etc. Part of the responsibility of users' cluelessness falls on us. We need to find better ways to communicate to the average user, who has a minimal understanding of technology, in a way that is meaningful to them.