The app makes it pretty obvious and easy to control whether your profile is private or public, and if it's public, you can easily hide any activity. They've even got a "privacy screen" feature where you can set a geofence, and activities that start or end within the geofence are automatically made private.
If you purposely disengaged from this social part of the app and were trying to use it as a simple stopwatch and mileage logger then uploading data may seem weird. But that's not the clearly intended purpose of the app.
Doesn't look like they're actually public, though? https://www.strava.com/athletes/22230419
That is easy to change, but again there is the opt-int vs opt-out discussion.
You’re not supposed to be using a device which logs and beams your GPS coördinates when deployed. The fact that this is widespread means superiors failed to communicate and enforce some very basic rules.
(it's also very much in their interests not to have "delete Strava" as the first recommendation given to anyone starting a sensitive job)