Why should any of that be enabled by default?

The claim was that you had to install packages to make the system useful, but it in fact has a lot of useful stuff included.

The fact that vulnerabilities in the packages you mention wouldn't count towards the "2 remote holes" as they're not enabled in the default install?