It's wild that none of these are set by default.
I know 90% of people I've worked with will never know these options exist.
If everyone or a majority of people sets these options, then I think issues will simply be discovered later. So if other people run into them first, better for us, because then the issues have a chance of being fixed once our acceptable package/version age is reached.
That would likely mean same amount of people get the vulnerability, just 7 days later.