TrustedForDelegation when using ServiceLogonAccount

During the Join of the Storage account to the domain, when the ObjectType is set to ServiceLogonAccount the AD-User Account that is created is configured with"TrustedForDelegation $true" (Line 2382 in v0.1.2.0).
This Kerberos delegation is not scope.
This is a pretty high and critical permission:
https://docs.microsoft.com/en-us/archive/blogs/pie/credential-theft-made-easy-with-kerberos-delegation

As this is not done when creating a computer account and is not mentioned in the docs when creating this manually I would like to know if this is really required and if so how it can be scoped.
If it is really required i would really not choose to use a useraccount but a computeraccount and roll oder the kerberos keys regularly.

Inspect line 2382 in version 0.1.2.0 and compare the ServiceLogonAccount join behavior with computer-account creation. Determine whether TrustedForDelegation is required, whether it can be scoped safely, and what configuration or documentation change would define the expected behavior.

Written by the indexing model from the issue text.