Unfortunately this is the default value for :httpc and a lot of HTTP libraries build on top of it directly or indirectly, and some of them may use this insecure default, looking at you Tesla:
https://github.com/teamon/tesla/issues/293
Now, even when HTTP libraries don’t use the insecure defaults you may “accidentally override” it when customizing the library. I say accidentally because if the library doesn’t merge the configuration you pass in with the one it uses internally to secure :httpc, then you just have replaced accidentally them.
You may want to take a look to this talk from @voltone:
