release-it jobs run on hotfix- branches

A branch named hotfix- created a full release pipeline, including tagging and pushing to the remote registry. Looking in the auto-devops/release-it.yml this appears to be intended behaviour, but was unusual to see (and caught me by surprise).

After a teamIdentity standup that discussed this we wonder if it's a good feature to include by default. We would not expect unreviewed code from a branch to get released (even if it is a hotfix). If this feature is definitely desirable for some projects, perhaps it should be opt-in rather than default behaviour? If the intention is to only release semantic -dev/rcX type releases, is there some way to ensure hotfix pipelines enforce this?