If it was really about security (in the sense of that which benefits the end user) they'd just stick it behind a toggle and be done with it. I just think it's important to call out the misalignment - security can refer to the interests of the end user, or alternatively to the vendor. The ambiguity is convenient for PR statements.