Seriously, how could an ISP think it's a good idea to have the default settings for wireless to be A) on, and B) unprotected?
There is a very specific reason why routers from both ISPs and manufacturers come with wireless on and unprotected.
They don't want people buying the things plugging them in and immediately calling their expensive call centers asking stupid questions about why the thing doesn't work.
They want the average consumer to be able to plug it in and for it to work.
It's up to you to lock the door.