Why is rememberMe a hidden field?

There is a field in the login form called rememberMe? To me, making this a hidden field that is always on is a security issue.

Has anyone converted this to a checkbox instead?

Try top modify the following code in inc/design.inc.php file near ~340 line:

            'rememberme' => array(
                'type' => 'hidden',
                'name' => 'rememberMe',
            	'value' => 'on',
            ),

to:

            'rememberme' => array(
                'type' => 'checkbox',
                'name' => 'rememberMe',
                'label' => _t('_Remember password'),
            ),

Any chance you'll incorporate this change? I would prefer to avoid custom changes. It makes things harder to maintain.

You can implement this modification without modifying the core core, you can catch 'profile' -> 'show_login_form' alert and modify this field since form object is passed as parameter for this 'alert'