What is HTTP Part V - HTTP Profile Basic Settings

The HTTP protocol is not strict on this front. Accept XFF is indeed the migrated Trust XFF setting from ASM, and is for stats purposes. ASM has its own logic on what IP in an XFF to trust as well. I won't speak for PD, but I assume they did not want to a) set limits in the generic HTTP filter where the protocol itself is silent and b) decide for users how that logic should work.