I actually work in security so I'm torn on the subject too, but I know that pissing off users in the name of security is just as bad. Because then they're more likely to shun security altogether.

The right answer, in my opinion, is to force reboots by default but to allow the option to disable it.