A 3 character password might as well not exist. The point of an automatic
login is so that over the network you are protected as the password can be
strong and such. However, locally, you don't have to worry about it. A
short password is worse because over the network the short password is still
nearly as insecure as not having one at all. Suppose it is all about how
secure you believe your network to be.

I know there is an option in GDM, try poking around with the login setup,
the same screen that you can configure your login GDM theme from. I know it
is in there somewhere.

Additionally, auto login has the bonus of not giving users the choice of
going into xterm or any failsafe modes from GDM. Right into your default
environment.