Change default security of `ftplib.FTP_TLS`

Bug report

Bug description:

Hi!

It has come to my attention that the ftplib.FTP_TLS class shyly notes in its documentation — it does not warning — that it is insecure by default: it leaves the data connection without TLS and vulnerable to man-in-the-middle attacks. Documenting that calling .prot_p() closes that hole is better than nothing but misses the point: vulnerable defaults need to be fixed, just XML parsers must not be vulnerable to XXE by default.

To see the issue in action, you can run this script…

# /usr/bin/env python3
# Copyright (c) 2026 Sebastian Pipping <sebastian@pipping.org>
# SPDX-License-Identifier: 0BSD

from sys import stdout
from ftplib import FTP_TLS

ftps = FTP_TLS('test.rebex.net')
ftps.login(user="demo", passwd="password")
ftps.retrbinary('RETR readme.txt', stdout.buffer.write)  # <-- MITM here
ftps.quit()

…and watch sudo tcpdump -i any -A 2>/dev/null | grep -F "Rebex FTP/SSL" output in another terminal to see the MITM in action.

A pull request with a fix and extending documention on security is upcoming.

I'm looking forward to your review and am hoping for your support 🙏

Related:

• issue #91826 is another unfixed MITM vector due to lack of FTPS certificate validation 😞
• issue #63699 is breaking FTPS with most servers for 12+ years now, would be great to have that fixed 🙏

CC @The-Compiler @hannob @nitram2342

CPython versions tested on:

3.9, 3.10, 3.11, 3.12, 3.13, 3.14, 3.15, CPython main branch

Operating systems tested on:

Linux, macOS, Windows, Other

Linked PRs

• gh-143498

Start at the ftplib.FTP_TLS entry point and its linked documentation, then review the reproduction showing an unprotected data connection. Check the linked PR gh-143498 for work already underway; completion should address the insecure default and document the resulting security behavior.