Yes, it's more robust to provide a setup macro, which is why most modern packages do that. Parsing key=value options is problematic, even if you use the new mechanism of the raw options list (as do `\ProcessKeyOptions`, `expkv-opt`, and `scrbase`) everything passed there has to survive a round of `\zap@space` (since the zapped list will still be assigned). Expansion control might help with that (in `\ProcessKeyOptions`-using lists you can use `key:c = macro` instead of `key = \macro` to pass in `\macro` without that being fully expanded in the zapping list, similarly in `expkv-opt`-parsing you can use `c: key = macro` to achieve the same -- unfortunately `l3keys` doesn't use the same syntax as `expkv`)
