I mostly agree with Alison(OP) that this is a bit troubling from a security, privacy(linked but not the same as security) and PR perspective. When I am presented with Opt-out statements, I immediately have a negative bias in how I feel about the entity at the other end of the agreement. They clearly do not value my interests at all and are only looking to take advantage.
While I understand that some may wish to use this feature, each site owner/admin should have the ability to offer an Opt-in option AND the option to disable the feature all together.This should be doable easily from the Admin menus.
Having to modify code to disable such an intrusive feature is not a good alternative.