But the default is ftp. If you don't explicitly choose sftp and an attacker blocks the ssh port and spoofs an ftp server, FileZilla will happily send the password for the attacker to intercept.