I agree it makes it obvious what the right default behaviour should
be: flag every FD as sensitive by default, and pass an argument to say
"sensitive=False" when you want to disable Python's automatic
protections.
"sensitive" is a bad name... because the data passed via an open
descriptor that _should_ be passed may well be sensitive, so saying
sensitive=False is false... it's just necessary to leave the
descriptor open to make things work...