"This is exactly why privacy by default should be non-negotiable. Most users don’t even know what settings to check."