If it’s security or privacy related that should be driven by your own threat-modelling and risk assessment. Not left to the fate of what the community decide. You’re the experts after all and that’s what people using your service pay for and expect.