Yes, they add the js if "web analytics" is enabled. I believe I had to manually enable it on my old sites though. Maybe it's enabled by default when adding new domains?

No, I hadn’t enabled for any site. I had to enable first to turn it off.

Maybe send it to them as a bug. Seems more like a mistake than malevolence.

They have a blog post about it so they know what they're doing.