BIP 77 specifies that it must be disabled in the URI for a v1 compatible receiver, because the directory acts as an unsecured payjoin server from the standpoint of BIP 78 senders, who do not use end to end encryption.

Prior to #466, pjos=0 was set matching the spec:

However, it appears that in #466 the corresponding field was renamed disable_output_substitution, and was later renamed back to output_substitution in the PayjoinExtras struct, but the value of false was retained, and this incorrect behavior has apparently survived a few refactorings... While I'm reasonably confident this is indeed just a bug, I didn't get to the bottom of how this confusion was introduced, so it's possible I missed something, so @DanGould can you please confirm this wasn't intentional? I kind of got lost what with the same boolean blindness that motivated the change to an enum in the first place looking at the history and it seems simpler to ask.

See also bitcoin/bips#1887