By default, only one authentication method is available, the network protocol is not encrypted, and the server stores clear text passwords. (All these things can be changed by configuring SASL, but it’s a bit more work to do.)
No logging of any kind, not even errors.
No built-in web browsing. (You’d have to install a separate web server and repository browsing software to add this.)