I think it's preferable not to push fixes as long as people are made aware of the risks they're running. So there should be an automatic opt-in but an option to opt out with suitable warnings issued at the time.