Does this imply having
_disableInitializers();in the constructor is a new standard way or at least recommended way of usingUUPSUpgradeablecompliant logic contract?
Yes, this is recommended as described in https://docs.openzeppelin.com/contracts/4.x/api/proxy#Initializable
The OZ already fixed the problem by adding
onlyProxymodifier to upgrade functions. This means nobody can callupgradeToAndCallon the implementation. What other risks do you see if you leave implementation uninitialized?
You are correct that the previous UUPS vulnerability was fixed by restricting the upgrade functions to onlyProxy, but disabling initializers is still recommended as a best practice to provide an extra layer of protection against these types of attacks.