If your goal is to onboard nontechnical users quickly and not have to deal with them churning because they have to deal with thinking about those pesky "security rules" before they can get a working app, it totally makes sense that you would do this, especially if you just drop a get out of jail free "well, it's the end user's fault for not configuring their app securely" in your T&C.

Somehow it's okay to simultaneously set a golden path to less secure software to support your hockey stick growth model and then turn around and blame end users when it all goes wrong.