Would be nice if each option set could have a simple toggle for “Make public”, meaning they are private by default. I love option sets for the performance benefits and to keep my data types clean. But if I’m building internal apps (or where the users are known to me e.g. suppliers), I would be happier putting more data into option sets if there were some privacy considerations. The issue is that an unknown user can get at all option set data from the login page. In an ideal world, I would want some “public” option sets that download with each page request, and some “private” option sets that only download with authenticated page requests. I understand they are never going to be properly secure, but some things just need a basic privacy option to keep from unknown users.
I believe Option Sets exist to restrict the type of a certain field rather than to store data, so it wouldn’t make a real difference if you’re using them correctly.
Maybe that is why they were created, but its not the only way they are used. Page navigation in single page apps is a common use case where the option set is unrelated to the data model. Even if option sets were just used to control input values on a data type as you suggest, there are many reasons why I might not want to expose those values beyond authenticated users, at least in some cases.