True, but if you don't have it enabled / required then you're giving off signals of negligence which may extend into other vulnerabilities.