The intention was to fail safe. If someone forgets to set immutable, then it's better to default to the safer mode.

I don't know when we'll be done developing or changing rulesets, so even if we default to false we'll still need to send a change through that overrides the default. After we've done that, we're in exactly the same situation.

But our module was made a little bit less safe.