The Apple engineer must have signed at least one NDA [to do field testing with a prototype iPhone] so why didn't he use [read enable] the auto lock feature?
You mean, why didn't he use a passcode on the lock screen? For the same reason everyone else who doesn't, doesn't: it's an annoying step that adds little practical security for something you keep on your person at all times. Since Apple remotely tracks and disables the prototypes anyway, which presumably includes instant wiping when plugged into an unauthorized computer as well as remote wiping the instant it's reported lost (as happened here), what's the point?
Here, someone would have to lose the prototype (rare, but obviously not impossible), someone else would have to then find it, keep it, realize that it wasn't a regular iPhone, snoop around at an inappropriate depth to search for UI changes not already documented in the SDK, and photograph them--all before Apple remotely wiped the device. That's a pretty tall order, especially considering that the real value was the hardware.
He now basically enabled/helped the finder to find out stuff that was not supposed to be revealed, prematurely, to other people.
Except that nothing related to the software was revealed.
Wrapping it up in a case, to conceal it, is in my opinion not enough.
The case is just for practical concealment to avoid attracting attention in public.
Why did he leave this expensive [top secret] iPhone prototype on a bar stool when he walked away from it?
Because he lost it, as people do? People forget things in stores, restaurants, train stations, and bars all the time.
this guy isn't totally clean either!
Based on what? He accidentally left something important in a public place. It's colossally bad luck, but he was supposed to be field testing. He could have left it at Starbucks with the same result. When you send prototypes out into the world for testing, you have to accept the chance that one might be misplaced.
Apple, it seems, has pretty comprehensive measures for limiting access, further limiting possession, tracking and remotely disabling them, concealing them from public view. But you can't control everything.
The finder probably would have been rewarded had he done the right thing and returned it either to the engineer or to Apple, but he knew he stood to make more money by selling it, and that's what he did. That conduct is inexcusable, regardless of whether it was an iPhone prototype, Prada sunglasses, or a little girl's teddy bear.