Disabled by default means a feature ships in the off position until a user or administrator explicitly turns it on. In cyber security, defaults matter because most people keep the original setting. If a privacy filter, logging option, or network control is disabled by default, it provides no protection until someone enables it. That makes discovery, user education, and configuration management important parts of defense.
Attackers benefit when useful protections remain off, because users may never activate them or may not realize they exist. Defenders also use disabled-by-default settings for optional features that could affect compatibility or performance. In the Firefox iPhone context, a built-in ad blocker and tracker protection setting only helps after the user opts in. The key lesson is simple: secure defaults reduce risk, but any off-by-default control should be reviewed to decide whether it should stay optional or be enabled everywhere.