A list's unsubscription_policy should default to SubscriptionPolicy.confirm
The current default is SubscriptionPolicy.open. This is bad as it allows any 3rd party to maliciously unsubscribe anyone from a list. Given this, SubscriptionPolicy.open should probably be not allowed, but certainly shouldn't be the default.