2 ms·

Or it is defense in depth. Although blocking it even if the / is percent encoded seems a bit excessive, especially as a default.