That's fair, and you're right to challenge that point in an attempt to keep instances out of mixed-mode, I do the same. The reality is that it just takes one legacy app, or one client that cannot support Windows Auth, to cause it to be enabled.