I know the plugin is supposed to lock down the site by default when it is activated, but this does not happen when the plugin is activated via Network Activate (WP 3.0)
Other sites would show that the plugin is activated, but the sites would still be public (not locked down).