There was a time (a very long time ago) when upgrading the kernel would
have broken existing setups if the default would have been "block all".
IIRC ipf itself changed the default.

There was a violent discusion and since then we always kept the "pass all"
default.

Think of sites without any ipf rules (ipf is in GENERIC).

Check the Archives for details.

Martin