You get authorization in the free offering and that's been the case for the least two major versions.
The things you need to pay for are IMHO not hobby project stuff, like integration with LDAP/AD.
You are of course correct that this used to be the case, and that to some extend this sentiment prevails.
But I feel Elastic (the company) deserves credit for acknowledging the issue and addressing it.
The "security issues" mostly stem from people intentionally running it without a firewall completely unprotected on the public internet. And then they put important data in there. Simple solution: don't do that, it's stupid and negligent and it's 100% your fault if data leaks like that.
You wouldn't run a database on the internet either. But if you must run it on the public internet, just put nginx in front of it with basic auth and https. Problem solved. Not that hard.
Alternatively, use the hosted version which doesn't allow you to do that at all and is nice and easy to get started with.