Well only the product managers can answer "why?". I would venture to guess all defaults are a considered balance between ease of usability and best practices.
The vulnerability is easily mitigated so perhaps that's the thinking. It's most common in my experience to not allow ssh to any public interface. So that in itself restricts the vulnerability to inside hackers. Plus if you go the the trouble of allowing ssh at all (not allowed by default) just check the box (or add the cli option) to restrict ssh to v2.
