So…
SVG is sanitized.
At the time I read the code, my judgement was that the sanitization was actually fairly robust, and that gave me confidence to enable it on my site.
I can understand if CDCK doesn’t want the responsibility of making that call for everyone, particularly since the sanitized SVG doesn’t meet all needs for SVGs. For example, on my site, sometimes people post SVGs intended for laser cutting, and occasionally the modifications applied in that sanitization have silently broken them for that purpose.
So I understand reluctance to just enable it by default, even though it was a minor annoyance to me when I was doing configuration.