Why is unattended-upgrades activated by default?

Another way to disable unattended upgrades is to

Edit /etc/apt/apt.conf.d/20auto-updates and set "Unattended-Upgrade" to "0".

APT::Periodic::Unattended-Upgrade "0";

I can't explain why it gives you the option and then ignores your response. Without installing, I can't confirm that behaviour, however, it's easy to fix it.

Edit /etc/apt/apt.conf.d/50unattended-upgrades and comment out the -security line.

// Automatically upgrade packages from these (origin:archive) pairs
Unattended-Upgrade::Allowed-Origins {
//      "${distro_id}:${distro_codename}-security";
//      "${distro_id}:${distro_codename}-updates";
//      "${distro_id}:${distro_codename}-proposed";
//      "${distro_id}:${distro_codename}-backports";
};