Is FileVault insecure by default with EFI auto-login enabled?
FileVault2 is full-disk encryption. At pre-boot you can enter the recovery partition or boot from another disk, but not your FV disk without the decryption key (derived from your password). A firmware password takes care of being able to get into recovery or other boot disks, by the way.

The usefulness of FV is, if someone gets ahold of your data, it's useless without that decryption key, in this case coming from your password. Now once the disk itself is unlocked, there are accounts on that disk and each one may have stronger or weaker security, but it's a different layer now. Kind of like breaking into a bank with multiple doors; the firmware is one door, the file vault is another door, then you reach the user's doors.

Hope that helps.