continuwuity/changelog.d/2225.feature.md

Disable legacy, unauthenticated media (`allow_legacy_media`) by default as the Matrix ecosystem has completely sunsetted this functionality. Legacy media allows anyone to access a file just by knowing its URL, thereby turning homeservers into unwitting CDNs. Homeserver admins are strongly encouraged to check and turn off this option.