It doesn't default to public. When you hit 'post', whatever your journal's minimum security has been set to will be the level used; the form just doesn't yet update to reflect that. It will be fixed with the next push, but don't worry; if your journal is set to locked by default, there is literally no way to post unlocked without editing after the fact.

Meanwhile, if you want to move the icon browser: hit the gear in the upper right corner, choose "Column alongside entry text", move icon browser up.