On my 2.2 device it's an opt-in feature.

It may be that with the EEE tablet Asus decided knowingly or accidentally to make it a default. Either way it's good to know such settings need to be checked on any and all Android devices.

Hopefully Google will come to their senses and require all manufacturers to ensure that manual opt-in is the default. But with Android being open-source I don't see how Google can enforce that - it's up to the consumers to (hopefully!) shun manufacturers who wish to risk our security with some lazy user-friendliness!