My family uses vikunja, especially the older generation will agonize in despair on every UX impasse.
More often than not, it happens to turn into a multi-day back and forth about fine tuning configuration.
In such a family & friends scenario, it is absolutely wired to have to enable user discoverability in the privacy setting.
Crazy out-of this world non-sense, if you think it through from my fathers perspective.
Please consider a global server config option. Despiteit often may feel otherwise, config time is much more well spent by the sys admin than end user support time.
Edit: a more solid variant would be to capture default (or enforced) settings from SSO extra vikunja claims (akin to vikunja_groups) or a dedicated vikunja SCIM schema (works with popular Pocket ID).