Passing an empty or partial options object disables the default protoAction: 'error' protection. A map containing a proto key can then replace the prototype of the decoded object, potentially changing inherited properties or causing unexpected behavior in downstream code.

Only the decoded object's prototype is affected; this does not modify Object.prototype globally.

Options are now merged with secure defaults without modifying the caller's object. Unsupported protoAction values are rejected.

Explicitly set protoAction: 'error' whenever constructing a msgpack5 instance, and validate decoded values before use.