Express Helmet also turns it off by default and included a rationale for why (tldr: privacy leaks when there are random external links posted on a page): https://helmetjs.github.io/docs/dns-prefetch-control/