There are a number of security issues which can come with symbolic links, especially with how user/group permissions are handled. There is also a lack of support for them in the ecosystem, which could introduce some strange problems (for example, whether specific apis follow them, or not). So I can understand why they're putting this behind a flag.