RPC security of bitcoind node
ie: notably one where I don't specify things like rpcuser, rpcpassword - is this insecure?

No, Bitcoin Core by default creates a RPC cookie file in the data directory on startup which is used in place of static authentication. Specifying a rpcuser and rpcpassword is deprecated, and they can't be blank regardless.