That’s probably a bug (or more accurately to the extent certain WAF rules are available universally to all customers including free, they still are) but the UI reflection of “On” is not accurate. There’s an open ticket internally and waiting on feedback but as far as I know there has been know change in behavior, nor is one planned.
Will update as more info becomes available.