Always On VPN, IKEv2, and Diffie Hellman

This article begs the question, why is this not the default?

https://docs.microsoft.com/en-us/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections

Is anyone here doing this? I assume you would set the server side and then add the client powershell commands at the bottom of the user profile script and device profile script (assuming you are using powershell scripts). 

If you are using an MDM, is this even an option? I mean, I suppose you could run the powershell commands in another manner after the MDM applies the profiles but it needs the name of each profile so if you add a new profile name or change one down the road, you now have to run the powershell commands all over again for each new name.. but also you have to verify the client has the new profile name first or the command fails obviously.