continuwuity/changelog.d/2225.feature.md

Disable legacy, unauthenticated media (allow_legacy_media) by default as the Matrix ecosystem has completely sunsetted this functionality. Legacy media allows anyone to access a file just by knowing its URL, thereby turning homeservers into unwitting CDNs. Homeserver admins are strongly encouraged to check and turn off this option.