Why no need to make it the default? I’m all for rethinking legacy decisions.

It helps 99% of the user base and the security risk seems negligible.

Rethinking would imply there was thinking going on. This decision was made on vibes alone.