Disabling it would increase the attack area for a malicious app that could somehow gain elevated access.

Since it is possible to disable, why not disable it as-needed rather than always?