On Meteor 1.8.1 this is maybe true for browser-policy package, but it is not really true for any realistic Meteor app these days because apps use ecmascript which requires dynamic-import, which enabled eval by default. So in practice, by default, eval is enabled. See #10704.

It should be probably clarified in the README that the package by default keeps it disabled, but Meteor apps by default enable it because of dynamic-import and that you should remove dynamic-import package if you want to get it disabled (I hope that resolution of #10704 will be that one can remove dynamic-import).

See: https://github.com/meteor/meteor/tree/devel/packages/browser-policy