I just realized 35deaab moved allow blocks from metadata to config.

Could this result in previously secured instances opening up when the upgrade is applied? If so, it would be better to fail hard (like we used to with plugin configuration prior to #2248).