I can only speak anecdotally, but from what I've seen firsthand the user does need to approve. In fact, the user needs to approve almost everything, unless they choose to put the CLI into "auto-mode" which should just be assumed is at one's own risk.

In regard to settings.local.json I've only ever seen it automatically created gitignored. I'm not saying it's not possible for the user to prompt in some way to intentionally or accidentally bypass that, but still.

At some point this honestly isn't Anthropic's problem. And a developer that takes the stance of "privacy and security is the responsibility of my toolkit" is one that is either very green, or reckless.