@kmj People follow guides they find on YouTube or in someone's blog where security is either an afterthough or not even considered at all. Most prople are not professional administrators and all they know is that setting up a server will solve some specific problem they have, and if the guide they are following never mentions anything about a firewall they are sure not going to consider anything that would make the setup more difficult than it already is. I blame the people who write these guides or put up these videos, although to be fair those folks often have no idea how to implement good security practices themselves.

Now is someone really is a professional administrator (thery are getting paid to set up such systems) then this is stuff they had better know. But many of them are either lazy, or (if underpaid and treated like an intelligent robot by their employers) even actively hoping the systems they administer get hacked! If your employer only pays peanuts and disrespects you and your needs at every turn, maybe you'd like to see them have to pay out millions after they get hacked, and since it is pretty hard to prove administrator negligence ("my employer never asked me to implement better security") chances are that administrator will find another job somewhere else. I am not saying all admins are like that but just as there are bad cops and bad judges and bad doctors, there are also bad professional administrators!