They could auto-enable it but also allow you to take it away in Settings. Kind of like how Google Chrome gives websites permission to execute Javascript by default, but you can disable it in site settings (in vanilla Google Chrome, without any extensions like noscript).