Purple Knight flagged “Authenticated Users can add DNS records” (SI000183) on 300+ zones — is this default behaviour, and what’s the safe way to remediate?

Running Purple Knight (Community) against our AD, and SI000183 – Authenticated Users can add DNS records came up against 330+ AD-integrated DNS zones. Before I touch anything I want to sanity-check my understanding with people who've remediated this.

My understanding — is this correct?

1. By default, the Authenticated Users group holds the CreateChild permission on AD-integrated DNS zones.
2. Every account that successfully logs in is automatically a member of Authenticated Users (unlike Everyone, which can include non-authenticated/anonymous access).
3. So by default, any authenticated user in the domain can create DNS records — no elevated rights needed.

Questions:

• Why does Purple Knight flag this / why should it be removed? I understand the ADIDNS spoofing → MitM/credential-theft angle, but is Low severity accurate given how easy it is to abuse?
• Since this looks like a Microsoft default, is removing it actually recommended, or is it "by design" for dynamic DNS registration?
• Before remediation — what should I do first? My plan is: (a) back up the current ACL of each zone (dsacls > file), (b) confirm Domain Computers (or the group that handles auto-registration) already has CreateChild before removing it from Authenticated Users, so machine DNS registration doesn't break.
• How are people remediating at scale (300+ zones)? Is dsacls /G "Domain Computers:CC" then dsacls /R "Authenticated Users" per zone the right approach, or is there a cleaner PowerShell way?
• Any gotchas / things that broke in your environment after removing this?

Appreciate any real-world experience. Thanks!