So worst case scenario it does nothing, and best case scenario it protects against a common security risk? Seems to me it should be standard...