Indeed, just checked with v2.8.13, a version that is at least 5 months old, and it has the recommended setting set to 'false'.

I'm not sure why this is news? Its set to false by default in the latest version of TimThumb.
I do agree with Chip Bennett though, solid statement.