Fair comment about it being configurable (actually it is easy to do in Luci) but since nobody (including GL) has yet explained what it does exactly and the related security implications, then I don’t really agree that this is a “dummies” option that should be accessible in the GUI. And surely the default should be “0”.
Actually it was a VPN provider (more than one) that advised unchecking the Masquerading option.