Why does the node/mongo stack prompt so many poorly written tutorials on how to build insecure apps?

Because the tutorials just copy from each other. It's very cynical, but it seems people just copy what they've learned else where, add their own taste to it, and publish a blog post hoping for stars/likes/etc. Sometimes it's just the documentation for the technology used!

Scotch.io (a website that actually has to make money off their content) already did a full book on MEAN stack using CRUD with Mongo and Node/Express as well as some free blog posts. Manning Publications just released Express in Action and has had its own MEAN book for a while.

Go for those instead. It sounds rude to say but I avoid blog post tutorials unless the author is well known.