Auto-login is simply a convenience feature. By default, on the local console or UI, it provides the ability to not have to enter your user password before continuing loading the user's environment.
It's insecure only if anyone else has direct, physical access to your Pi. Over SSH remotely, the user's password will still be required (so you definitely should change it, even if you don't have auto-login!). It doesn't affect a REST or other API (ie. web server) running on the Pi either.
So, to repeat, auto-login is a convenience, that only affects the person logging into the physical device.
Personally, I use it on all my Pis (I have numerous in various testing/development environments), but it's quite rare I use my Pis directly. Typically I set up SSH keys and connect remotely. Only time I use direct access is for network related changes. This allows me to have crazy passwords that I don't need to remember. On the console, it auto-logs in, and over SSH, I use identity keys.