Yes, it's enabled by default, I purposely disable it. Number of reasons, but number 1 is, my secret keys should not be in the same address space as any networking code, let alone networking code that talks to completely un-trusted networks all day long. My node is sitting in it's own dmz network behind a dozen other protections. Given the opportunity to disable software features I don't use, I will disable them.

I'm sure Sparrow uses the watchaddress (or something like that) rpc call, as it's easy and somewhat fast. I was hoping he'd use the getutxoset rpc call instead and cache the results. You don't need to use the wallet function to see UTXO's with core.