It's carved out as a specific permission on the privacy page now - https://www.strava.com/settings/privacy - and also explicitly mentioned as turned off for "only you" activities, but no mention if it's exposed if your activity is "followers only".