I've read that Universal Password is optional when implementing NFAP, but
strongly recommended.

If it's strongly recommended, why it's not enabled by default?

What are the disadvantages of enabling Universal Password?

A. Madrid