Default user not confgurable and open

In the clickhouse chart, CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT is set to 1,  
resulting in the default user always getting created (in users.d/default-user.xml) without password and accessable from  
any IP address (::/0), overriding the settings in users.xml.  

Am I missing something, or is this intended behaviour?
Should CLICKHOUSE_SKIP_USER_SETUP also be set to 1 by default to avoid this?