You're correct, it would go at the module level and fire on import.

I think that's fine for the purposes of letting folks know that default_roles is going away, but if it's not too much trouble it's probably best to remove any usage of default_roles project-wide as part of this pull.