TYPO3 Core

I recently had to do a dive into the TYPO3 password hashing code (TYPO3\CMS\Core\Crypto\PasswordHashing), because of some related performance issues.
At that time, I noticed what I consider a dangerous check mechanism on the argon2 cost parameters.

PHP added global constants that set the default settings for argon2 generation costs, PASSWORD_ARGON2_DEFAULT_MEMORY_COST, PASSWORD_ARGON2_DEFAULT_TIME_COST and PASSWORD_ARGON2_DEFAULT_THREADS.

TYPO3 has, arguably sanely, decided to up these default to improve hash quality. (I would personally consider it saner to let PHP decide and increase this as CPUs get faster, but it's not unreasonable).
As part of this TYPO3 has decided that it will allow the user to change this value, but the user must NEVER set it lower than the PHP settings and so checks those and throws an exception if it fails.
TYPO3, however, does NOT check whether the PHP defaults are higher than its own settings, before setting them.

The result is that if PHPs defaults ever get higher than TYPO3s, for instance if PHP decides to increase the "memory_cost", the entire hashing library will start returning InvalidArgumentException for all calls. Given that these settings are likely to increase as CPUs get faster, this seems like a dangerous timebomb to leave lying around.

I would suggest one from this list:
1: If the TYPO3 default becomes lower than the PHP default, just use the PHP default.
2: TYPO3 just use the PHP defaults and leave the decision to increase complexity to the PHP developers/users.
3: TYPO3 should log a warning/error with an intimidating message, instead of an exception.