This brings to mind all those “First steps to make Unbuntu/Windows/OSX/etc after a new installation” articles out there. Look, if there are guides on how to make the OS secure post install, then the OS developers can damn well read those guides too and start shipping operating systems that default to secure instead of the other way around.