I tested with a friend and the bi-directional clipboard is enabled by default. Anything the host copies from the start of the session (even without mouse and keyboard enabled) is copied from the host machine and paste-able by connected clients. It would ease my mind a bit if there was a third option for clipboard, if it was only "client to host", only "client to host" by default, or if it was tied to keyboard control. Having it enabled by default without any warning is spooky, especially if dealing with strangers.