1. Is not a bug. The skin preview is also used to support a printer friendly view of the page with ?skin=printerfriendly
and it is also intended for non admins to be able to preview any skin. This makes it possible to work on a new skin and send a link to colleagues for review. A user cannot make the site use a different skin without permission for user specific skins enabled, but they can append the preview link manually to any url, I don't see a problem with that. If you don't like it you could always remove extra skins from the /Data/Sites/[SiteID]//skins folder
2. There is a setting in the blog for "Require Authentication for Comments". However this only works when using the internal comment system, it does not affect use of Disqus or IntenseDebate.
3. Possibly a bug, but which feature? which captcha? Steps to produce the problem.
4. Also not a bug, it is a feature request that has been logged already. It isn't trivial to implement and it is low priority. If it is a high priority for you perhaps you could implement it and submit changes.