The idea is to make development easier, when in Learning and PoC modes, but when running in production, the Framework should lock things down and only allow 'secure defaults'
Ideally the gap between these 3 modes is not very high, but having them is a good compromise between the needs of the framework developer to gain market share, the ability to learn a new Framework and the need to write secure code on it.
This would also address the problem of code-samples with security issues