How to permission the initialize function in upgradeable contracts?

Question

From what I understand, for UUPS proxies: the proxy contract is ERC1967Proxy.sol from OpenZeppelin Contracts and the implementation contract should inherit from UUPSUpgradeable.sol in OpenZeppelin Contracts-Upgradeable

But it seems like a malicious actor could easily initialize the the implementation before the deployer. I'd like to initialize the admin in the constructor of the proxy contract. It seems like I can use the admin slot: 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103 and then permission the initialize function to the admin — would this be safe? Why isn't it set this way by default?

Answer 1

This is the constructor for ERC1967Proxy.sol:

constructor(address _logic, bytes memory _data) payable {
     _upgradeToAndCall(_logic, _data, false);
}

The _data param is an optional encoded call to the implementation/logic contract where you can call the initializer function atomically on deployment (or make any arbitrary call to the logic contract)