The intent was on better TPM security after a prior security demonstration showed TPM key recovery from Microsoft Windows BitLocker as well as TPM sniffing attacks.

I am not sure if this is a good change. Isn't this "dangerous"?

The hope is that now it's disabled by default, the Linux kernel developers can spend more time evaluating the security benefits and performance optimizations to make it worthwhile to re-enabled by default in a future Linux kernel version.

I'm confused. They disable security feature and then want spend time on the benefits and performance optimizations, to possible enable it again?

That probably makes sense. Most people don't have the risk of a malicious actor sniffing their TPM bus and those that do can opt in. Everybody else can still benefit from a TPM

@cm0002 Never understood why one should use tpm when there are good old passwords. It would be better to enforce a long password. To me TPM always looked like a marketing strategy masked by security tools: in the end it's a device that makes it mandatory to use your hard-drive on a specific machine. It's even weaker than a good password. Am I wrong?