Someone incorrectly expecting zaps to be private by default (when they are not) is harmed more than someone incorrectly expecting zaps to be public by default (when they are not). But it does feel weird for someone to expect they're private by default.