From the last two answers on autorun bugs one may think that
NOT using autorun is a user option but is is not.
Autorun is starting from /usr/bin/startkde. Users (non-root)
cannot uninstall it or change /usr/bin/startkde.

Other aspects:
1. I'm not sure about the security issue. If more than one user
   may log on the computer autorun is still running on the UID of
  the first session.

2. On Pinstripe I got error messages on login (something about
   dcopserver) that I believe are related to autorun. They were gone
   after uninstalling it.

3. IMHO it should be possible to do ALL the CD (and other removable
   devices) operations and configuration from their respective
   desktop icon.