Is lazy loading really that widely used? I used it once and it led to all sorts of issues unless I managed everything myself. I much prefer to have it off and rely on explicitly getting what I need.

I notice for complicated apps you often want to turn it off, but development time probably is slightly faster on simple apps with lazy loading and is the previous default.

I would probably want eager loading to be the default, but lazy would be useful for porting old code at minimum.

Kestrel was "more suitable as an Internet-facing server" at 2.0 https://blogs.msdn.microsoft.com/webdev/2017/08/25/asp-net-c...

Section: Kestrel Hardening

Limits and timeouts were added to Kestrel in 2.0 that enable it to be supported for use as an Internet facing web server (we made that announcement then too). Reverse proxies are still advised for defense in depth of course.