I realize you're referring specifically to general .au, but I don't think the average person will think to try foo.au instead of foo.com.au and .com.au isn't opened up to my knowledge. The name must be derived from your registered Australian business (ACN or ABN).
I've had a .net.au since 1999 and the same rules apply there.