On Universal Music Group's Airflow Leak

This post presents a common dilemma: Should frameworks optimize for being easy to start with for local dev by default or production ready config by default?

In the Universal Music case, the contractor made some bad decisions around not using Airflow's specific built-in features for operators as well as encrypted connections. Should frameworks make it harder for this to happen by accident?