I have one distribution that I use that I really like. It has a web shell installed by default. I don’t even know how to disable it. But i wish it was easier to disable. I really only use this distro on my virtual environments, it’s not really portable enough to install into a public facing site.
But still the fact remains that web shells and other tools like that are very powerful, and I think that everyone should make them easier to disable or at least easier to restrict to a single IP address or something.
My favorite web hosting control panel is called HestiaCp and it makes it easy to restrict nearly anything to a few IP addresses.