(3) DNN's configuration leads admins to leave IIS vulnerable
I took a look at this, and I'm not convinced this is true but the recommended configuration is not necessarily the most secure. Not so much in what it recommends as in what it leaves out. The question then becomes, when is it the application's duty to provide instructions on securing non-application functions? When you install Internet Explorer it secures IE as well as recommneds security settings. But it doesn't tell you to test your firewall. Or patch your operating system. Should it?
This points out a major flaw in the use of DNN. Not in DNN, but in the way it is used, often beyond the intended use. DNN is popular, and being used as a portal instead of just a framework. Users with little or no IIS knowledge, or ASP.NET or SQL knowledge, can install DNN and get a reasonable site configured. Then, when there are problems, such as security, they have nowhere to turn other than blaming DNN. It's really nobody's fault, other than the user not being an expert in multiple disciplines and DNN in not restricting its use to users who have passed qualification testing. Neither of those is realistic.
Since its inception, DNN has grown to have more of an out-of-the-box ability to be up and running. Maybe a branch to a version that is just for users to create a site is appropriate. Probably not.
Jeff