Insecure defaults are always bad. The other way round would be the right choice. Let users downgrade their security for performance, if they insist.