I want to agree, but I can’t.
If a server is unable to identify a relationship path or does not support inclusion of resources from a path, it MUST respond with 400 Bad Request.
This only says that it must respond with 400 Bad Request if the client asks for something that doesn’t exist or is not supported. It does not have anything to do with whether the endpoint should give included resources by default or not.
From what I have read and understood so far, there are no documented rules or conventions concerning this situation.
The problem with not including all relations by default is that it creates a different result from an endpoint that does not support the include parameter. I can see how this would be an inconvenience for people using different APIs following the JSON API standard, and I think that trumps the more “common sense” approach of returning no included resources by default.
But something in the documentation about this would be useful, nevertheless.