Turning off "ask to join networks" also stops your phone from connecting to open networks automatically. It will still autoconnect to networks that you have previously connected to, though, unless you explicitly tell it to forget that network.
Exactly. Also: auto-joining open WiFi networks—especially generically-named ones—is a pretty serious security risk. So easy to spoof an SSID and capture everything that's traversing it.
Alas, there's no auto-enable-upon-connection VPN, of which I'm aware. And if your device connects to an open SSID while in your pocket, you're not even aware of it.
