About a year ago, Microsoft has disabled guest access to NAS devices in Windows 10. As their community website explains, this was done for security reasons:
While the server may be fine not distinguishing among clients for files [...], this can actually put you at risk elsewhere. Without an account and password, the client doesn't end up with a secure connection to the server. A malicious server can put itself in the middle (also known as the Man-In-The-Middle attack), and trick the client into sending files or accepting malicious data.
I must admit I don't understand this argument. How hard is it to create a malicious server that accepts any username/password? It looks like this explanation is dumbed down to the point it doesn't explain anything. Could someone explain how disabling guest access prevents MitM attacks in this case?