That's true, but some clients ask you to approve AUTH to a new relay. If that's important to you, use those clients or ask your client dev for that feature. It could just be a toggle, or something "ask before AUTHing".
Discussion
I just deny all AUTH in my signer. That waybindont have to find the setting in every client / believe they will honour it.
Well, then I'm not sure what the problem is.
If relays deny requests for public events unless they have received an AUTH response, then it becomes a big problem. I won't be able to read a users public events from their outbox relays.