This isn't entirely true, a fresh install will prove differently.
[root@db01 ~]# mariadb -A
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 3
Server version: 10.7.3-MariaDB MariaDB Server
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]> select user,host from mysql.user;
----------------------+
| User | Host |
----------------------+
| db01 | |
| localhost | |
| mariadb.sys | localhost |
| mysql | localhost |
| root | localhost |
----------------------+
5 rows in set (0.003 sec)
MariaDB [(none)]> show databases;
--------------------
| Database |
--------------------
| information_schema |
| mysql |
| performance_schema |
| sys |
| test |
--------------------
5 rows in set (0.001 sec)
I do share the exasperation of its excessive use (like FLUSH PRIVILEGES everywhere). I even had to add add a notice in the docker library entrypoint for mariadb based on user misinformatio.
Writing descriptions (like MDEV-27613) for upgrade and other packaging things does add to the harmful perception.
It removes anonymous users – but the default MariaDB installation has none
It removes the test database – but the default MariaDB installation has none
You are right for Debian, and rpm
packages. Possibly some other distros. Notably as luke.smith showed earlier anonymous user and test database is there. When installed using mysql_install_db --auth-root-authentication-method=normal is the case where the option where mysql_secure_installation is "strongly recommended".
anel and I did get to writing a large amount of mysql_secure_installation fixes latest year, which addresses some issues, but others like writing temporary config file containing the password, like mysql_upgrade, isn't done. It stalled because it just because too big a change to be considered stable. Constraints like not-bash means that work arounds like this (before or after implementation), and a few other scripting constructs aren't as easy.
Maybe as an option we should revert to a server assisted implementation as an installed stored procedure and cut back mysql_install_db to calling it rather than trying to do it all in shell.
I don't think we can totally drop it as "this is useless", but we could advice use the user like "unless you have done mysql_install_db --auth-root-authentication-method=normal, or have set a weak root password", your system is already secure." (+ maybe something around skip-test-db because that isn't default).
danblack's suggestion to advise the user when running it seems to make sense.