You seem to have the wrong answer selected. The check boxes you have circled in your graphic clearly only apply to Machines that have a maintenance window defined. It plainly says as much in the line of text above the check boxes. In SCCM, if no maintenance window is assigned, it is assumed that it's ok to maintain that server any old time. Which makes perfect sense. If you'd like those check boxes to apply to your deployments, then you need to set a maintenance window. If you set one in the past, and specify no recurrence then the maintenance window has expired for everything in that collection and there will never be another maintenance window for it. In this scenario, the only way they can be installed now, is if you do it manually.
Caveat: This is only true if those machines are not in any other collections with recurring maintenance windows. In that scenario, this maintenance window is ignored since it is expired, and the other will be observed since they are cumulative.
Seems pretty straight forward to me. And yes, the behavior is by design.. You just designed your deployment wrong. :)
Your mistake was in assuming that since no maintenance window is defined, it's NEVER ok to install those patches, when exactly the opposite is true. The reason for this is that people need to be able to install patches and software, and make changes to systems whether or not a maintenance window is defined. (think highly reboot tolerant machines like workstations.) For these systems the extra step of defining maintenance windows is cumbersome, and can cause problems with software distribution, etc., due to overlap of policies, etc. This way allows to you keep the number of maintenance windows to a minimum, and hence easy to manage and predict what the behavior will be for your deployment.
As you have it set in your image.. If you had a maintenance window set in the past, with no recurrence, you would have exactly the behavior that you wanted. :)
All of this being said.. Now if you throw the various group policy settings that govern automatic updates into the mix, it can be very confusing. Microsoft could simplify the interface for software updates quite a bit, or add some explanations to the settings that exist. That goes for SCCM 2007 as well.