I'll agree that there should be an option during the configuration (say, when you're setting your password) to turn auto-login on or off, though, since most users are on desktop machines and most users maintain a low security profile, defaulting to off makes sense.
You'll also note that in Windows Vista and earlier (sorry, I'm not yet running 7), Auto-Login and Require Password on Wakeup are not one and the same option and must be changed separately. In fact, this is also a good usability feature; a setting should control one and only one thing. Yes, it would be nice if there was a pretty little link to the related options, but that relationship isn't clear in Vista Home's User management either.
I'll absolutely agree that the firewall defaulting to off is a bad thing.
As for blakeyrat's #4, I'll simply point out that you're being foolish. Don't use the Dock for launching apps unless you run maybe one or two VERY often - use the keyboard shortcuts. Option+Q to quit apps, I set Option+Space to enable Spotlight; I launch all my apps from Spotlight. Oh, and it's Option+T to cycle between apps. Sadly, in a potential usability fail, while Option+Space is the default Spotlight launch key, you have to enable the keyboard shortcut in Spotlight's Preferences panel on 10.6.