> The problem with ssh-agent defaults is that someone with root on the server you're SSH'd into can use your SSH private key (which is on your local machine).

> ssh-agent is like temporarily uploading your private key to each remote server logged into.

That is very different (and much more common) than an attacker having root on your local machine.