Hmmm ... this is parallel to the Python module behavior, where `import *` from a module without `__all__` gives you all names defined in the module. However, does this defeat our purpose here, to remove a security footgun?