Specifically...
I don't understand how in a new Rails 5.2 app, if you enter the console and check Rails.application.config.action_controller.default_protect_from_forgery it'll return true
...but an upgraded Rails 5.2 app, if you enter the console and check Rails.application.config.action_controller.default_protect_from_forgery it'll return nil (unless you've manually set in config/initializers/new_framework_defaults_5_2.rb)
This GitHub comment mentions this behavior, but I don't understand how this works & I haven't been able to find any documentation yet.
WIP Update: This issue seems like the point where it was decided to not include new_framework_defaults* files in newly generated apps. Then this pull request mentions that new_framework_defaults_* files are only kept on a rolling basis. I'm still looking into why/how...
To load the defaults (i.e config/initializers/new_framework_defaults_5_2.rb) in Rails 5.2, make the following change in application.rb
config.load_defaults 5.2
Then remove new_framework_defaults_5_2.rb from initializers