Unintended public collection exposure via Meteor autopublish

Goal: confirm whether Meteor's current stable release treats autopublish as an optional development convenience or enforces removal or warnings before deployment, and identify the exact default publication behavior when the package is present.

When autopublish is installed, all MongoDB collections are published to every connected client by default. Production guidance recommends removing autopublish and insecure, but the framework has not finalized deprecation or opt-in enforcement for new projects. Documentation may describe Meteor 1.x behavior rather than Meteor 3.x, leaving the default package set uncertain for review.

Does Meteor 3.x enable autopublish in new projects by default, or is it manually added? Is there a build-time warning when autopublish remains in a production deployment? Which collections are exposed to clients while the package is active?