Yes. If the privacy control only exists per user, it isn't a control for a team.

Defaults matter more than the blog post. "You can opt out" is not the same product as "the org can actually enforce opt out."