Web servers ship with default settings optimized for ease of use, not security. They often have unnecessary services enabled, default credentials, or verbose error messages. Options A, B, and C are incorrect because servers require deliberate hardening after installation to be secure.