That's what I'm taking issue with. I don't like the feature, hence I don't use it. But why default to faulting them for adding a feature that's clearly useful enough for some to justify being hackily implemented?

As someone presumably technically capable wouldn't the first step be ensuring sync is off, routing through a pi or whatever and firing up Wireshark to check whether it's even possible that something malicious is going on? I'm not saying it's not - I have no idea. But I'd certainly have a look before making any claims.