I can't really speak for the Plex developers. But as an ecommerce developer myself, I feel confident that the answer is that best practice is always to make the

I can't really speak for the Plex developers. But as an ecommerce developer myself, I feel confident that the answer is that best practice is always to make the default settings the configuration that maximizes security protections. If you, the user, want to back that off trading security to get more convenience, fine, but it's on you, not on me.