Certain setups will not allow you to turn it off with .htaccess. Your host would need to do it for you in some cases.

It is regarded as a little less safe, but if the your site works it's not a total hack prone configuration. Many sites have url include on.

So if your site works then this isn't a huge risk or deal. Something to think about though in the future.