That's a very interesting question. The answer is that it depends on the K8s distribution in question.

One of the challenges of K8s security is that there are a wide variety of distributions, each with their own defaults and configuration, so it's hard to make blanket statements about their security.

I've definitely seen some with this issue out of the box.