I suppose the target of users is basically all users who can login to the desktop. Basically enabling only the socket, the remote login can be excluded. And the check of the PA setup can be done in the pulseaudio.service itself. Not sure about the question "when", though. If it's at adding user, this won't work only by the system updates / upgrades.