Why is this not done by default?
x = 2 implicitly creating properties on the global object. Varargs-related bugs are annoying, but they were never close to being the most annoying part of the language.
Also because it's likely very hard to implement. Since functions are first-class values, there's nothing stopping you from replacing a two-argument function with a three-argument function at runtime. If we wanted the language to enforce the correct argument count at all call sites, it would have to start every function call start by asking the function how many arguments it currently takes. That's likely to be a performance problem, and it won't protect you from anything that you can't already protect yourself from.
Why was it like this in the early days? No idea. If I was to guess, I'd say because this reduces the number of things the interpreter has to keep track of.
Is there any use of default varags (in comparison to explicitly stating that a function takes a variable number of arguments)?
Even "default varargs" is understating it. All functions are variadic no matter what. You can't even opt out of it. You can only choose to throw an error at runtime if you don't like the arguments you were called with.
Since a lot less than 100% of real-world functions take a variable number of arguments, it's definitely a misfeature.
Would it make sense to implement this in common libraries so that less users shoot themselves in the foot?
If you're asking whether your assert library should be asserting its argument counts, that depends on a lot of things. But there's one in particular I think is worth pointing out in your example: assert.ok() could also catch that mistake by checking the types of the arguments it expects to get (i.e., the second argument should be a string), and that would probably lead to a better error message anyway.
I would generally prefer to focus on validating the arguments you are expecting to get. Explicitly checking the argument count too won't hurt, but it's definitely not necessary and probably never the top priority. If you have several arguments of the same type or potentially any type in a row, such that checking types alone won't detect this, that typically indicates a poorly-designed API rather than a need for argument count checking.