Broken access control means users can see or change things they shouldn't, and it has sat at the top of the OWASP Top 10 since 2021. I wanted to test one explanation for why it won't shift: that getting it right depends on facts only the application knows, like who owns a record or which customer it belongs to, which no framework default can supply.
I took a random sample of 40 authorisation advisories published on GitHub in 2025, each linked to the code change that fixed it, and asked of each fix whether it added a missing check, corrected a wrong one or redesigned the feature, and whether a simple framework default like "every page requires login" would have prevented the flaw. Two couldn't be assessed. Of the other 38, 18 added a missing check, 16 corrected a wrong one and 4 changed the design. Only 4 of the 38 were missing checks a simple default would have caught, and a second coding by another instance of the same model family found 3.
Most of the fixes were about ownership, tenancy, the target of an action, or workflow state, and a generic default can't supply any of those facts. Older research on small web applications found the opposite, with forgotten login checks the most common single bug, which is worth taking seriously rather than dismissing: it suggests the answer depends on what kind of software you're looking at. Some frameworks can also detect when no check was written at all, even if they can't say what the check should have been.
So for mature software with published advisories the explanation holds up, and for small applications simple defaults may well prevent more. What this doesn't do is measure why these flaws persist over time. It describes what their fixes look like, which is a narrower claim than the question invites.