aren't eternal Sessions pretty insecure? especially due to the fact that OE targets at being used online. (Imagine you login in an internet cafe or whateer public or semi-public place [like your colleagues terminal in the office on the upper floor], forget to logout, electricity dropout ...) Your whole data is exposed to that machine. Isn't it a little strange to have such by design?

Yes, I agree with you. But, we already live with this kind of problem (not limited to Odoo only). One solution to improve your Odoo service is to use full https. The tradeoff is usually convenience for user (such as performance), but this is only my opinion.