Basic security principles

[#1]

Disable any services or protocols that you don't (currently) use.

When will I be able to disable SIP on the Hub2?

[#2]

In what way exactly? The SIP ALG can be disabled and the embedded client is not configured to do anything.

[#3]

The log says 'SIP enabled'. (It is disabled on boot, then gets enabled)

There's no option to disable on the web interface.

[#4]

I can assure you, whether the client is running as a process or not, it is definitely not registering to a SIP server.