If I'm reading the spec right, it's up to the clients to offer the opt-out or opt-in. There is fortunately a section on privacy considerations.
I don't really think it matters what the spec says anyway. Who's going to enforce that? Like if it was required, would the server automatically reject messages if it didn't get a typing notification for an amount of time that's proportional to the length of the message?