Default web server configurations often have a lot of additional functionality turned on, for example, modules that you will never use. Such functionality can introduce attack vectors. Default configurations are also usually too forgiving, which makes it easier for attackers to exploit any weaknesses.
Learn how to harden a web server that uses nginx software.