we got some feedback that this is a pretty extreme vulnerability to have enabled automatically (remote code execution which runs as root) so it's now disabled by default