If you think about it, clearly, and logically the default value must be "off". This can be proven if you look at the use cases of the sign in life cycle.
Let me explain, by comparing the browsing behavior of two different types of users. User #A will be one who likes remember me disabled, and User #B likes to have it enabled. Let's compare what happens to both users given the two possible default values "on" and "off". NOTE: I'm talking about the risks of setting a default value.
Default for Remember Me is "off"
User #A when going to the website is presented with the log in screen. They enter their username/password and click the sign in button. They are granted access, but when they close the browser their session is ended. They will be prompted again for their password next time they visit, and this is good for this user.
User #B when going to the website it's the same thing. They enter their username/password and click sign in button (they forget to click "remember me"). When they leave, they are signed out. This is not "liked" by the user but there is no security problem.
Default for Remember Me is "on"
User #A goes to the website, enters their username/password and clicks the sign in button. Their session becomes permanent. The next time someone visits from that computer they will be granted access. This is not liked by this user, and is a security problem.
User #B goes to the website, enters their username/password and clicks the sign in button. Their session becomes permanent. This is accepted by the user, they don't mind the security risk
It's clear, that when remember me is on. Both use cases present a security problem when the user fails to change the state of the "remember me" check box. It doesn't really matter that User #B doesn't mind that the risk is there.
The point here is that when the default is "off", should both users login with out changing the value then there is no security risk.
Further more, now that many third-party websites are using open authentication. Users who leave themselves logged into Facebook/Google/Yahoo/Twitter are also granting access to thousands of other websites that use oAuth services for registration and authentication.
If someone gains access to your Facebook account, then they can go to the Apps section and gain access to all the other websites you've used Facebook to sign into. The same for Google, Twitter, GMail, etc.. etc..
How do you feel about auto remembering now? :)