given that apparmor isn't on default why should this be?

The default mode is "enabled". In "enabled" mode, AppArmor mediation will be performed if AppArmor support is available in the kernel. If it is not available, dbus-daemon will start but AppArmor mediation will not occur. In "disabled" mode, AppArmor mediation is disabled. In "required" mode, AppArmor mediation will be enabled if AppArmor support is available, otherwise dbus-daemon will refuse to start.

I think that is okay as a default or am I wrong here?

Interesting, we should for sure put that in the commit and code with some sort of link to the docs.
If we choose the default enabled, it will be the easiest for apparmor and non-apparmor users. If the support is in the kernel then it's on, which means that apparmor users don't have to switch a dbus option in configuration.nix. However, I don't see the apparmor module putting support into the kernel, from this line it shows me that the kernel already has it and just needs a kernel parameter https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/security/apparmor.nix#L32. I would think that apparmor support in the kernel would also implicate checking for that kernel parameter (along with other things), but I would like to at least check the startup is "as expected" without the apparmor module enabled.

I added some docs to the option.

I don't think linking to external docs is really helpful since you can either use the AppArmor GitLab which seems to be neither complete nor seems the link to be stable or you can use the dbus man page that doesn't allow direct linking to that list item since it's not a heading.