If WordPress auto-selected a category as part of it’s typical behavior, this would have gone unnoticed. The fact that it isn’t normal behavior is what made it present as a bug.
Requiring a category ID that the user has permission to edit makes sense. However, a user can still lose access to the post by deselecting the default category and then saving/publishing. The post then uses the default category set in WordPress settings. If the user doesn’t have access to the default WordPress category, then they are unable to edit the post they just created.
I’m not sure what all you’re able to control in the WordPress admin. At a minimum, requiring the default category be assigned based on the users settings would seem necessary to make this approach work without a user being able to circumvent it. To me, a more user friendly approach would be to disable the publish/draft buttons with a small note indicating that selecting a category is required.
