None of the 'features' involved are undocumented. Depending on the Windows SKU parts of these are opt-in (The business and server SKU's) or opt-out (the home/personal SKU's), and configurable through a documented registry key.

Security is very often if not always a trade-off with usability/convenience. In this case the security threat of having your service credentials potentially exposed on a consumer device when it has been physically compromised is traded with the convenience of having your notifications and appointments work when the device is on.

You can debate which side of the trade-off you would prefer to be the default in which case. Microsoft has made choices here, which you might or might not agree with, but at the very least they seem to have thought about it, and don't seem to be 'hiding' their default choices made or forcing them.

You mean security by obscurity?

I can't be the only one tired of this pedantic platitude.