alt Hacker NewsHonestly issues like this crop up pretty commonly. JWT alg:none for example. Or even older people forcing SSL to downgrade to encryption null.
In any system that provides security it should only be designed to run if the security is in use, and to fail immediately with no further action if the security is not used.
I was very surprised when I realized what defaults postgres uses when it comes to SSL. I can see how people consider it a pragmatic choice - but still...