Yes, it’s based on how many people have seen/downloaded the file etc. And other factors such as digital signature so you could get a lot of false positive warning thus why it’s off by default.