No, I hadn’t enabled for any site. I had to enable first to turn it off.

Maybe send it to them as a bug. Seems more like a mistake than malevolence.

They have a blog post about it so they know what they're doing.