It's also enabled by default if you don't customize your installation settings
No, that's not the case. What's enabled by default is that you automatically use a shared connection from a friend if you happen to be in range of that connection. The sharing part, i.e. the action the friend has to perform on their WiFi connection, is not enabled by default. So if you connect with your WiFi hub with Windows 10, you're not automatically sharing _that_ connection with your contacts.
This is a confusing topic though. Because it isn't all rosy and great indeed. If a person decides to share their WiFi connection (which is still a manual, non default action), and that person's contacts have all accepted the default settings, they all can log into the WiFi hub when they're in range. If they do come over with their Windows 10 devices, they then download the (encrypted) key to the WiFi hub. From then on they can use the WiFi hub on their own. It's unclear what happens when the contact is 'unfriended' or the connection is no longer shared: is the key then also removed (by whom?) pro-actively so they can no longer use the WiFi? Also, that MS is used as a hub to distribute keys among devices which are in close range of each other is not OK.
What's especially not OK are the apologists who dismiss criticism on Windows 10's invasive privacy (or should I say: anti-privacy) features as overreactions.
I use windows systems now for a very long time and windows 10 (I installed it in a VM for testing usage for my software) was the first windows OS which made me feel uncomfortable: I no longer felt in control of what the OS does and what will happen if I do a given action besides the action itself (e.g. what data is tracked and sent to MS...).