You should provide some specific counterpoints and sources to back said points up - because rolling their own encryption is by itself reason enough not to use them. defaulting encryption to off is just icing on the cake