I suspect it's so that a user can't accidentally make security worse by fiddling with security settings that they don't understand. That said, I might've consid

I suspect it's so that a user can't accidentally make security worse by fiddling with security settings that they don't understand. That said, I might've considered turning any page that had the disabled .htaccess settings into a 500 response instead of just keeping on like everything is working fine.