Is it enabled by default though?
AFAIK: No
It's not, but there is likely a small number people who have something like this configured:
Host * ForwardAgent yes
It's not, but there is likely a small number people who have something like this configured: