This seems to be a definite bug somewhere. I don’t know how many distros it happens in, but I know that it happens in Peppermint 8 and in Ubuntu Mate 17.10.
When you install either Peppermint 8 or Ubuntu Mate 17.10 and you tell it to automatically log in, it creates the file /etc/lightdm/lightdm.conf which tells it to login the user name you gave during the install automatically.
However, if you then go into users and groups and tell it to require the password
on login, it still does an automatic login !
The only way to require the password thereafter at login is to either edit that file and comment out the line that allows that user to auto login or else delete that file.
Once you have done that, it will then require the password at login.
If you then go back to users and groups and check for it not to require the password
at login, it will login automatically but it does not create that file, so that if you once again tell it to require the password at login, it will correctly do so.