I was going to say something like that, but slightly different, so I’ll still say it:
but:
please, please, pretty please disable this by default
I can see why some people might want to enable it, but for me it’s either “Disabled” or chmod 600 on appropriate update scripts…