RPC security of bitcoind node If I have a fairly default bitcoin.conf file, let's say:
rpcport=8332
txconfirmtarget=6

ie: notably one where I don't specify things like rpcuser, rpcpassword - is this insecure?
As I understand, this lets the node be queried locally without an authentication. However I'm not sure this is any more dangerous than wallet.dat sitting around - local access would mean private key access.
Are default settings of bitcoin insecure?
ie: notably one where I don't specify things like rpcuser, rpcpassword - is this insecure?

No, Bitcoin Core by default creates a RPC cookie file in the data directory on startup which is used in place of static authentication. Specifying a rpcuser and rpcpassword is deprecated, and they can't be blank regardless.