Should be mod_security enabled by defautl?

There are multiple module packages installed as part of groupinstall of jbcs-httpd24, but only mod_security is enabled. Other modules have their configs present only as .sample files. What is the reason for enabling mod_security by default?

Actual state:

.qa.[root@hp-dl380pgen8-02-vm-7]# find /opt/rh/jbcs-httpd24/root/ -name "*mod_security.conf"
/opt/rh/jbcs-httpd24/root/etc/httpd/conf.d/mod_security.conf
/opt/rh/jbcs-httpd24/root/etc/httpd/conf.modules.d/10-mod_security.conf

Expected:
/opt/rh/jbcs-httpd24/root/etc/httpd/conf.d/mod_security.conf.sample
/opt/rh/jbcs-httpd24/root/etc/httpd/conf.modules.d/10-mod_security.conf.sample

rhn-engineering-jclererhn-support-csutherl WDYT?