What would be the implications of this? Just that tomcat is listening on the debug port?
Literally “SDK” means software developers kit, and anyone who is doing development should want to be able to debug. In that sense I vote for doing it by default. (I always configure it on my sdk servers.)
However if we intend for the SDK to be used to deploy production instances this would be bad. @burke, and @rafal, what are you envisioning on this front?