As per OpenZeppelins (OZ) recommendation, The guidelines are now to make it impossible for anyone to run initialize on an implementation contract, by adding an empty constructor with the initializer modifier. So the implementation contract gets initialized automatically upon deployment.
Note that this behaviour is also incorporated the OZ Wizard since the UUPS vulnerability discovery: Additionally, we modified the code generated by the Wizard 19 to include a constructor that automatically initializes the implementation when deployed.
Furthermore, this thwarts any attempts to frontrun the initialization tx of these contracts:
