Generally, the programmer is trying to make life easier. Insecure defaults might lead to a violation here, too. Many programmers will just stick with the default, as long as it works, because that's easiest. This problem is starting to become common in security policies for products intended to run in a restricted environment. For example, some vendors offer applications that work as Java applets.
Applets constitute mobile code, which Web browsers tend to treat with suspicion.
Such code is run in a sandbox, where the behavior of the applet is restricted based on a security policy that a user agrees upon. Vendors rarely practice the principle of least privilege here, because it takes a lot of effort on their part. People generally install vendor-supplied security policies, maybe because they trust the vendor, or maybe because it's too much of a hassle to figure out what security policy does the best job of minimizing the privileges that must be granted to the vendor's application. Let's say you go on vacation, and you need a pet sitter. You'd like to limit the sitter's access to just your garage, where you'll leave your pets while you're gone, but if you don't have a garage with a separate lock, then you have no choice but to give the sitter access to the entire house.