why do vanilla MySQL packages come with SLEEP() even enabled? Why not make it an option?
Because it's a good "canary" for SQL injection: it doesn't do any real damage, but it's noticeable enough to tell you that you have a possibly vulnerable condition.