In case of btcpayserver the default onion service is a security risk because any visitor can register an admin account on a freshly setup node.