In regard to your first question, the VScroller and HScroller components will automate the adding of scrollbars for you like most Flex 3 containers did. The reason you probably haven't seen much on this is because I think those containers were added fairly late during the Flex 4 beta.
In regard to your second question, AMF is secure as long as (and only if) you are communicating over https. In other words, if you have an SSL for domain xyz.com and provided that you load the flash or flex app with
https://xyz.com, the AMF messages will be just as hard (or easy, depending on how you look at it) to intercept and decrypt as any other type of request.