...why do you think that that is bad? ...who do you think that is bad for?

The subscriber who ought reasonably to know that their free, open internet connection might be used by people who'd rather not take responsibility for their own traffic. Testing the reasonableness of this belief is for a court. Might a prudent person anticipate the arrival of such a person? Might a prudent person notice the internet usage on their bill didn't match up with what they themselves had done?

That there is a legal responsibility to "change your default WEP key"?

No such responsibility exists. I was cleaving the difference between accidentally leaving your shit open and deliberately creating an ad-hoc isp in your basement.

I looked around a lot on the internet but I couldn't find any Canadian laws that say "you are responsible for anything and everything downloaded through this connection".

I looked for it on my contract with my ISP, and I found it. That might not be enough to establish my liability of course, but it would go a long way towards proving my knowledge that misuse of my connection is possible, inspiring me to take reasonable steps to protect it. Deliberately opening it is the opposite of that.