I read that port scanning services like nmap will conduct a "TCP Connect Scan". They'll attempt to make a TCP connection to each of the ports within the range provided. But because each of these connections will be logged, it is easy for a system administrator to notice that someone has scanned their ports. So a more stealthy method is the "TCP SYN Scan". This method will close the connection after recieving the "SYN + ACK" packet from the server, thus it can determine which ports are open but because it doesn't complete the connection the server doesn't record it in its logs.
What are the drawbacks of the "TCP SYN Scan"? I assume there must be some drawback, if it was simply better then surely it would be the default option on nmap, but instead you need to enable it with -sS. Is it in some way less effective than a TCP connect scan?
Bonus question: In practice do servers log unsuccessful TCP connections too? (That seems like an easy way to defeat the stealth of a "TCP SYN Scan".