Google has made deploying Anthos clusters an easy, automated process. Because the process is automated, administrators may not consider anything past the initial simple cluster creation. When you deploy a cluster without considering postinstallation tasks like security, the likelihood is high that an attacker will be able to take control of your cluster with little effort.
Like many base installations of a product, a new Kubernetes cluster will include few, if any, enhanced security settings. For most enterprise systems, this setup is by design. Rather than force a rigid security model on an organization, potentially enabling features that may not be usable in some organizations, Kubernetes designers opt to make security a post-cluster-installation process that is designed and implemented by the organization.