I think it's enabled by default, but you can also just disable it for specific apps.

But if you leave it enabled and permissions get revoked after a while, you'll get a notification telling you about it. I think that's fair.

There's always going to be a debate on whether something like this should be opt-in or opt-out, but for the purpose of privacy and data security, it makes sense to be on by default, I reckon.