Yes - you are quite correct. Digium have tightened up IAX trunking security in Asterisk-1.4.28 and the new parameter is now necessary.
There are quite a few references to it on the web. I think we should revisit it to see what the possible consequences of running with it off might be.
Good input
Best
S