Yep, I use auto-login for my HTPC, but as added protection I use a normal User ID, not a Power User or Administrator.
I don't bother with locking the screen though, as I want people to be able to just reboot the HTPC and have it start up in MC Theatre View, without users needing to know any passwords.