[Golden]

Well there's all the lazy people who just take one look at terminal and hate it.  So they grab VestaCP since it's a one liner installation by copying and pasting the installation command onto terminal for it to start downloading everything onto the container.  Don't you find that convenient anyway?  But sticking with only terminal via ssh and uploading and downloading files via sftp would be the most secured way to manage a web server if you can protect your ssh server properly so bruteforce hackers won't get into your server.

It happens due to exploit on the code. Most people don't even know how to use Ubuntu Server let alone use a terminal. They will just copy + paste what they see on the instructions.