Not OP, but agent forwarding is a significant concern.
replyIs it enabled by default though?
replyAFAIK: No
It's not, but there is likely a small number people who have something like this configured:
reply Host *
ForwardAgent yes