Why should it be changed in mysql client? It's an independent option with its own semantics. It should not be automatically changed if we change the default value of server's secure-auth option.

I mean, we can change it, of course, but this would need a better reasoning than “the server has it changed.”

It was changed in MySQL 5.6 in 2012 at the same time as sql-common/client.c ( https://github.com/mysql/mysql-server/commit/ef3723981ccfde6f0db416df56f3e7460f5d15aa ). That's an observation, not a reason, but if the intention is to make sure no one is unknowingly using the old, insecure, pre MySQL 4.1 hashes, and nudge them towards updating them if they are, I don't see why we would want to keep a different default for the mysql client when it's been changed everywhere else.

Assigning to sanja so it does not get forgotten.
Sanja, please note Sergei's doubts above and check with him before making the actual change.

As I can see if secure connection is possible (i.e. used modern server and client) it will be established.
The option for mysql command line client in fact just prohibit connection to old servers. So I do not see why we should make this new default.