`EnableWebSocketSecurity` is not 1:1 replacement for `AbstractSecurityWebSocketMessageBrokerConfigurer`

Describe the bug
When using AbstractSecurityWebSocketMessageBrokerConfigurer we can override sameOriginDisabled and enable or disable the CsrfChannelInterceptor. In configureClientInboundChannel it does

if (!sameOriginDisabled()) {
    registration.interceptors(this.context.getBean(CsrfChannelInterceptor.class));
}

However, with @EnableWebSocketSecurity it is not possible to disable it since in configureClientInboundChannel it does

ChannelInterceptor csrfChannelInterceptor = getBeanOrNull(CSRF_CHANNEL_INTERCEPTOR_BEAN_NAME, ChannelInterceptor.class);
    if (csrfChannelInterceptor != null) {
        this.csrfChannelInterceptor = csrfChannelInterceptor;
    }

and in the configuration itself it is already defined through

private ChannelInterceptor csrfChannelInterceptor = new XorCsrfChannelInterceptor();

The same sameOriginDisabled is also used in afterSingletonsInstantiated to configure the CSRF for the handler mappings.

Expected behavior
Provide a 1:1 replacement for the deprecated AbstractSecurityWebSocketMessageBrokerConfigurer