Note that var decoding is still allowed for StreamPeer.get_var.
I think we need to add an object_decoding property to StreamPeer too (which could be probably cherry picked to 3.0.).

That sounds good to me.

I'm also wondering, if we should change the defaults for decode_variant and encode_variant to be safe (no object decoding), and update all their usage where we want object encoding/decoding with the extra parameter to true.

I agree, it's better that the defaults are safe. We can't expect people to read the documentation to ensure that their use of these APIs is safe, so it's better that they have to read them to find out how to use the unsafe behaviour when needed :)

It's a slight compat breakage but that's justified for security purposes IMO.