Is this new behaviour? I haven't set up a new device recently, but it always asked me if I want to enable that or not.

The arbitrary remote code execution vulnerability is much more troubling and critical, however. Most people don't realize that by running syncthing they grant the syncthing developer the ability to execute any code they want on their machine (including the ability to read or exfiltrate any file on the filesystem).

I find this a curious, borderline alarmist framing of the automatic update mechanism. Many pieces of software have automatic updates. What you say is no less true for common programs like Firefox or Google Chrome.

Obviously you have to consider your threat model, but the number of people willing to trust a specific Syncthing binary they're downloading from the internet, but who are wary of trusting published updates going forward, must be relatively small.

(I am a Linux user and use the OS packages rather than automatic updates, but automatic updates are quite common outside of Linux distro packages)

Anyone who can compromise the syncthing release process can run code on thousands of devices.

The only solution is to blank a few URLs in the configuration for things that can't be disabled. Then at first sight it seems to work... But you check your firewall logs a few days later and what do you know? Some dropped connection attempts.

Still, there aren't many alternatives that work as well as SyncThing, so you gotta pick your battles...