At the moment I think it's a case of waiting until the tipping point, i.e. when the majority of Windows (or other) installations require authentication then it makes sense for it to be enabled by default in the LibreELEC Samba Server. At the moment only Windows 10 users with the Fall Creators update (released Feb 2018) require authentication by default, which leaves a vast number of Windows (and non-Windows other) users that do not require authentication by default.
Perhaps closer to the time of LE9 release this can be reviewed - admittedly the Fall Creators update has been quite, erm, "popular" thanks to Microsoft essentially forcing it on Windows 10 users, so it may be the case that Win 10 + FC will have exceeded 50% share later in the year (at the time of writing total Win10 market share is about 46%).
So, yes, authentication is likely something we can enable as the default in *new* installations of LE9, but IMHO the timing isn't quite right for LE8. Also, the authentication setting is unlikely to be changed for *existing* LibreELEC installations when upgrading to LibreELEC 9 - after all, if the old LibreELEC installation doesn't need to be authenticated then nor will their new upgraded LibreELEC installation.
And finally, if users do something beyond our control and upgrade their Microsoft client (ie. Windows 10) so that it suddenly starts requiring authentication and subsequently fails with an obscure "Operation not permitted" error, there's very little we can do about that - it's up to the user to now reconfigure their LibreELEC Server to match the security requirements of their newly upgraded Microsoft client,
However I'm sure we will get used to answering posts in the forum when users mention "SMB", "Windows 10" and "Operation not permitted". Answer: "Enable authentication in the LibreELEC Server".
As with anything which involves migrating users to increased default security, it will take time for most users to make the transition, and the early days will be the most painful.