script injection allowed by default

Because cross site or XSS is to do with Javascript where in the case of blocking these things can mean broken webpages or webpages that don't display properly. You need to know how to navigate around if you were to enable XSS prevention like this and therefore it does not make sense to have these enabled by default as the generic computer user would not know what to do.

Basically the web browser cannot determine if JS is legit or not well it cannot do so very well in some contexts and its easy for people to do bad things with JS, This is what XSS blocking is about.

These policy only apply to Internet Explorer, and maybe Edge not sure on Edge though. So if you don't use these then its not an issue.

- - - Updated - - -

X-XSS-Protection - HTTP | MDN

It is also an older system that is vulnerable. Content-Security-Policy is the newer better version.

Try3 said:

All we see is that Group policy has not been used to alter the mechanism. That is all that "Not configured" means.

I did not write that the policy is disabled.
When policies that "Turn on" something are "Not configured", the somethings are not turned on.

I believe it. (even had thought of the possibility that it might be that way)
What about vice-versa, an enabled policy that contradicts a registry setting -- does the setting change accordingly?