I agree — the bigger problem is that the default isn’t that all methods/functions aren’t set to private, unless the community agrees that they should be globally callable.

This is a mindset problem, not a developer problem. The foundation of the system should be set up to generally block or restrict activity — and only to permit specific agreed activities that are needed.