Why didn't Bitcoin implement segwit in the first place? Why didn't Bitcoin implement segwit in the first place?

Why and how does non-segwit Bitcoin enable a miner to change a transaction's txid?

From Mastering Bitcoin ch. 7 § "Transaction identifiers":


  Before segwit, transactions could have their signatures subtly modified by third parties, changing their transaction ID (hash) without changing any fundamental properties (inputs, outputs, amounts).
Why didn't Bitcoin implement segwit in the first place?


The reason Bitcoin didn't initially have SegWit is up to interpretation, I would say that it simply was not thought of prior to transaction malleability. Although that is not its only goal. Segregated Witness was an idea proposed in BIP 141 as a soft-fork, meaning it did not require an entire network upgrade. Due to the nature of a soft-fork, it is backwards compatible with previous versions of the Bitcoin software. Over time, it has been gradually adopted. 


  Why and how does non-segwit Bitcoin enable a miner to change a transaction's txid?


Mastering Bitcoin is referring to something called transaction malleability. Traditionally, the txid was a hash of ALL the data in the transaction including the signatures. Transaction malleability meant a signature could be slightly modified such that the txid would be changed entirely while the signature still remained valid.

As David has mentioned in his own answer:


  changing even a single byte in the transaction completely changes the transaction ID.


This created an opportunity for a "Denial-of-Service" attack where while the transaction was still valid, and every part of the transaction would have the same inputs/outputs, nodes could reject modified transactions and prevent them from confirming. With SegWit, the signatures (as implied by the name "Segregated Witness") are no longer part of this hash. Eliminating the issue entirely.

I recommend reading this article for more information on how exactly it is done in practice.