They also already have installation from external sources turned on by default.

Why the hell are they trying to baby people who turn it off? They read the warning, they know the risks.