Privacy settings not applied to new blogs -- help!

Despite checking only "Only allow a registered user to see a site for which they are registered to." newly created blogs are public and visible to search engines, not-logged-in users, etc. Very bad! Help!

We're also using Blog Templates with the "Copy Status? Check if you want also to copy the blog status (Public or not)" set to YES. The template blog is properly protected and not public. Turning this setting to NO seems to have no effect.

Thank you!

PS We're also having the problem where "Applying to sites" shows up in every Network Admin panel until the cookie is manually cleared. This is a horrid bug and according to the forums it should have been fixed versions ago, but I am still getting it.