Earlier quoted context omitted.
And that is exactly why, at least on Android phones, the out of box Plus configuration is to automatically upload all pictures that are taken on a phone.
You've got to have misstated that. That would be a complete and total disaster of enough scale to completely kill Plus.
They're uploaded as 'private' by default, and it's a configurable option, so you can turn the auto-upload feature off altogether. Actually, maybe I did, because I think it asked me the first time whether or not I want auto-upload on or off by default; but even with it on, I don't feel even remotely unsafe -- the photos are automatically backed up to 'the cloud' and aren't shared unless I go in and explicitly share them.