The default setting should be to respect the privacy of the user first. Since they know most users will blindly go with the default, it's an asshole play.