Sigh.

Anything that isn’t a default is optional by default. Anything that’s toggleable or configurable is optional.

Security is, always, a trade off. It is hilariously common for private keys to work as a full identifier for a person, without concern of IP or anything of the sort. Should they? Maybe, maybe not, that’s the calculus of risk management; but victim-blaming the average person who is following best practices is a bad look.