I like the part where the Rails developer says:

The user has a flag to secure by default, I personally think that is enough. https://github.com/rails/rails/issues/5228#issuecomment-4300...

In other words, Rails actually does have a flag to make the mass assignment feature secure by default. But this flag defaults to 'false'.

https://github.com/rails/rails/pull/4062/files#diff-1