I think the point the parent is trying to make is why allow options 1-3 (disable protected mode) at all? Why not require only option 4 to accept non localhost connections?
Although that doesn’t stop someone setting up an install script with a “default” password that becomes known.
