..."the customer is always right" is so seventies. :)! Welcome to 2016...and Microsoft. I believe you have mistaken me for someone who works for, or represents, Microsoft. Nope.
*It is not a bug. That tick next to 'unsecured' connections can be removed and will remain removed. ANY other ticked 'secured' connections are possible connections and as one is not available attempt WILL be made at the following 'ticked' connection in the
list. In any case, automatic connection to ANY ticked 'secured' connection will not happen without an access code.
*Interesting (subjective) point of view. Run that by Microsoft and see how much they 'value' you as a customer.
Hold it....."...which I'm not sure there is or should be ", "problem" solved then? :)
*...doesn't work like that, for users who prefer ALL available 'secured' connections be 'ready' for attempt at connection, they are ticked in advance in anticipation of need. It will however remember those unticked 'unsecured' connections.
*"Another option is to get rid of the checkbox altogether until the first time a connection to the network is made.", see second and third points.
"NOTE: First time includes first time after forgetting about a network."....in which case the NEXT time you see that 'forgotten' network in your list you will no longer have ANY option to connect to it 'automatically (with access code') in future. :(