It is default on in win 11, which is probably a huge privacy improvement for a majority of users. The recovery is sent to microsoft with your microsoft account,

It is default on in win 11, which is probably a huge privacy improvement for a majority of users. The recovery is sent to microsoft with your microsoft account, but against 99% of attacks (petty criminals stealing your laptop) this suffices. If you fall into the category of users that distrust microsoft with their key, you can take active action and configure bitlocker yourself.