There is a major difference between uploading your dotfiles to github and shipping it as a mass-marketed distro.

At the very least they could have documented this sort of security trade-off if it actually is an intentional choice.