But why have an insecure random number generator as the default? Why not default to the secure one?

Because the secure one isn't available on all systems. If the library relied on random_device as a default, it wouldn't compile under those systems. If it used xint::strong_random_generator, it would compile, but would always fail on them.