Not sure your point. Who exactly do you anticipate is opt-ing?

The website owner's settings defaults to secure, and they can intentionally take action to make the website less secure if they'd like to. That is their decision, of course we do not default to a less secure posture.

What I meant. This default setting is the reason why Cloudflare is not off the hook here. This is the default, so website owners who don't care or know about it won't change it. Like all default settings where you have to actively change it.

Default settings should be secure. As the Cloudflare article points out, 94% of their traffic over Tor was malicious.

then at least force the user to set this. I don't care if the traffic is 'malicious' whatever the definition of that is.