Your statement is not entirely accurate. This only applies when using Direct IP Access on local networks, which is off by default. Their justification and invitation to PRs is the final comment [1] on the issue you linked. Why are you leaving this information out of your comment?
1 - https://github.com/rustdesk/rustdesk/issues/3714#issuecommen...
It may only apply to Direct IP Access, but isn't that what many would expect (not trusting middleman to be secure?)
I still think its an essential feature for self-hosting, but they seem to be open to PRs so what is the problem?