Not having "ForwardAgent yes" in ~/.ssh/config will do this automatically too.

Seems like a ridiculous amount of hoopla over something that isn't even a default.

Is "Host * \n AddKeysToAgent yes" acceptable from a security POV or should that also be per host?

Is it "yes" by default? If so, that seems insane given what the op said about it. But other comments say it's "no" by default. If it's "no" by default, why are people alarming us by bringing this up? And why for terminal.shop in particular?

The man page for ssh_config(5) says that it is set to "no" by default, at least on my computer.

Maybe there was some blanket advice in the past to enable it? Idk, this got me alarmed for nothing.

It's off by default. No idea what this fuzz is about. Gathering internet attention points maybe?