Well if we are going to disable registration by default, we could make it pretty obvious about spam protection setup when they have to turn registration on.
Valid point. Though I wouldn't like to bet on the number of 'but why can't users sign up for my forum?' support questions from first-time users.
True, there's only so much hand holding you can do. Or rather, should do. :D
I would be in favour of keep the registrations disabled just until the admin is created, from there on two options:
1) keep the current behaviour (i.e. registration open)
or
2) ask a question along the lines "create a public forum where anyone can register?" yes|no.
Of course option two has the drawback that people will ignore it when installing...though the question can be asked at the very beginning and made mandatory, that would work...maybe :P
Maybe "Require Admin approval" should be set as default setting. Registration would be open but no chance for spammers.
Could even go one step further, and create 'Email activation, then admin approval' and make that the default ;)