If default code security settings have not been changed at the repository, organization, or enterprise...

Bydefault,no repositoriesreceive Dependabot alerts unless configuration is explicitly enabled. GitHub doesnotenable Dependabot alerts automatically for any repositories unless:

The feature is turned on manually

It's configured at the organization or enterprise level via security policies

This includes public, private, and enterprise-owned repositories —manual activation is required.