Why is DBMS_CRYPTO inaccessible for most users by default? Oracle's DBMS_CRYPTO package is locked down by default. Very few users have permissions on it; the only ones on my database are SYSMAN, OWBSYS, and APEX_030200. (Of course the owning SYS has privileges, too.) These notably don't include even the default SYSTEM account. The documentation states


  Oracle Database installs this package in the SYS schema. You can then grant package access to existing users and roles as needed.


in the "Security Model" section, so the behavior is documented as normal.

But what I don't understand is why. I could not locate any information about the reason behind this default either in the package's documentation or the guide on using it. Is there some risk that these functions pose? Would granting access to PUBLIC be a bad idea for some reason?
A fundamental principle of Oracle security is everything is prohibited unless specifically granted.  You see this even in creating a new user.  Unless you specifically grant them CREATE SESSION (or a role that includes it) they can't even log on, even with proper credentials.  There is no reason grant execute on that package by default.  And keep in mind that there is really nothing "special" about SYSTEM.  It is just a default DBA user.  Also consider that DBMS_CRYPTO is of more use (in general) to apps developers, so why should it break the Principle of Least Privilege by making effectively available to everyone?