Maybe if it's a business level tool made in house with claude vs contracted to a software house in India. Never for a compiler, who even is that person?
Yes. But we usually start with a high default, and only recalibrate if there's a specific reason in a given situation (e.g. there's been a specific user or sets of users involved in spreading malware, and software in question could've been targeted).
Why do you care?
It's a stranger from the Internet. Same as with any other software you're using. In particular, same as with any OSS tool you're using.