"OpenAI found this in February reported it as unauthenticated remote code execution that works in both directions, so a malicious client can take over an unpatched server and a malicious server can take over an unpatched client that accepts compressed responses."

Every user is different

For me I'm a text-only user not interested in graphics

I do not use a so-called "modern" browser to make HTTP requests

I don't request brotli-compressed content/resources^1

Normally I don't send an Accept-Encoding header

Almost always servers to which I connect^2 will return uncompressed text, which is what I want. No Accept-Encoding header needed

Occasionally servers will send gzip-compressed text by default and will ignore "Accept-Encoding: identity"

However the popular so-called "modern" browsers will send an Accept-Encoding header whose value includes brotli (br) by default

Unsuspecting www users are consequently opted in to Google's brotli experiment. Me, I opt out

1. I use a text-only browser (1.3MB static binary) to read HTML. I compile it without brotli support

2. Other users may connect to different servers. Preferences vary from user to user