Actually, DotNetNuke has been written so that it, and all the core modules we ship, could work in medium trust, since October 2004. We did this for a number of reasons :
1. Being able to run DotNetNuke in medium trust is a large security benefit.
2. Early indication from Microsoft was that they were going to make changes to asp.net 2.0 so that medium trust was a commercial possibility (in asp.net 1.1 you cannot use oledb sources such as MS access in medium trust - so many hosts distregarded it)
3. Hosters began to let it be known that they were being advised by Microsoft to run asp.net 2.0 app's under medium trust, so not making it possible to run dotnetnuke in medium trust would have restricted it's use in many cases.
We test and develop all core modules in medium trust (hence the reason for the development.config file, which indicates the developement settings we use), and also have to live with the restrictions (e.g. we've love to add lots of webservice support - but under medium trust suppport for webservices are limited, so we don't use them), and encourage all 3rd party modules to use medium trust, but it's up to them naturally what they use e.g. I developed a few modules that use the system.net libraries to do whois, ping and tracert requests, none of which work in medium trust, but as I use them for intranets, i can adjust the trust policy accordingly.
As for the statement "To set Medium Trust you have to change it explicitely and it takes conscious user action to do so.
Hosters usualy change trust in machine.config, not in web.config and it is not possible to foresee what changes they will make, as they vary wildly, as far as I know."
In my experience this is not true - the majority of major hosting providers such as godaddy, webhost4life, pipex etc. all set their sites to run in medium trust in their machine.config and deny users the ability to override it. IMHO module developers should indicate the trust level their modules require, particularly if they do not run in medium trust, which is not the effective default trust level for asp.net 2.0 applications in many of the worlds largest hosting organisations.