Currently when you create a new Org Module it is turned ON by default for all profiles.

So once you create it you need to go over all profiles to take away access.

It makes a lot more sense that when we create a new module it is turned OFF by default for all Profiles and we should give access where needed.

This is important as it may create a bog access and security problem. I am aware that this does not provide access to the data in the module automatically, but still - it seems not great.