As discussed, we need a page for the overall story with this, so it's understandable for everyone without duplicates (like this explanation), but: It's not our decision to decide if the user installed squid or not. We can recommend against it and with blacklisting some packages we can send clear messages what must not be installed on systems. However, squid is a valid service and may be needed by some users. So once it's installed, the question boils down to: are we allowing its SUID/SGID bits or not? All services that are in the whitelist fall into one of 3 categories: whitelisted because service doesn't function without SUID/SGID bit, whitelisted because service doesn't pose a threat of being exploited (ping), or whitelisted because it's a fairly safe setting (eg. screen with sgid bit; separately discussed in chef-os-hardening).
Let's close this topic here and move it to the separate page as suggested.