Why is DBMS_CRYPTO inaccessible for most users by default?
A fundamental principle of Oracle security is everything is prohibited unless specifically granted.  You see this even in creating a new user.  Unless you specifically grant them CREATE SESSION (or a role that includes it) they can't even log on, even with proper credentials.  There is no reason grant execute on that package by default.  And keep in mind that there is really nothing "special" about SYSTEM.  It is just a default DBA user.  Also consider that DBMS_CRYPTO is of more use (in general) to apps developers, so why should it break the Principle of Least Privilege by making effectively available to everyone?