Currently the search results module is configured to display user search results. For upgrades, and also for new sites in countries where there might be legal reasons for this not to enable, this is a bad thing.
The option in search results settings should be disabled by default.
I definitely agree with Erik and there needs to be as well an option to prevent users being indexed.
The search box and search page does not display any data which the user has not already made public. The user is in complete control over what data they choose to make public and which they choose to make private. The addition of search does not change that.
Indexing users dies conflict with data privacy legislation in some areas, e.g. in Germany we are requested to store data only when needed and not unnecessarily twice.
Sebastian. You have full control whether user search is enabled or disabled. So disable the setting. We should set defaults which make sense for the largest percentage of our users, even though we know that for some users, it will be the wrong default. It is not possible to have a default which serves all parties.
Please see Joe's comments