Default values for optional security configurations?

[sosthene-nitrokey]

Some optional security configurations are by default not on the most secure setting:

• KDF-DO is off by default
• All UIF (require button press for Sign/Dec/Aut) are off by default.

Given that these features improve the security of the user but are not very discoverable (and even if a user becomes aware of KDF-DO, it can only be set when no keys are stored on the device), should we consider setting default values for these? I'm thinking unique randomly generated salts for KDF-DO for each device and UIF to enabled for all. KDF-DO would be especially great as it prevents leaking the length of the PIN with CHANGE REFERENCE DATA