Why do I need my password to generate a new receiving address in bitcoin-qt? I heard that the wallet has 100 of the next receiving addresses already.  Shouldn't I be able to get one of those without unlocking it?
The Bitcoin-Qt/bitcoind client will try to maintain a key pool of unused keys at an even size (default is 100 keys).  So each time you click "New key" it is going to try to add one to the key pool.

These keys in the key pool need to be encrypted, so your passphrase is required to do that.

The getnewaddress API call will, I believe, give you an address from the pool and if the wallet is locked, will simply deplete keys from the key pool without requiring the passphrase to replenish.