Having automatic updates as opt-in by default would be better to avoid supply chain attacks.

I guess the majority of users would prefer automatic data synchronization. The tool therefore offers the option of deactivating automatic synchronization (https://docs.atuin.sh/configuration/config/).

Also, if the original history file is still there it would be a good feature to be able to diff between the sqlite and the history file to see if commands have been deleted.

A solution can probably be created with https://docs.atuin.sh/reference/list/ in conjunction with a shell script.

Are there options to choose what encryption algo is used?

I suspect that this is not possible. Why do you want to change the type of encryption?