Excellent! I am always trying to help people understand not only when they are doing something insecure, but also why it's insecure :)
Joomla! 2.5.4 all by itself is not vulnerable, or at least no known vulnerability exists right now. Potentially, every bit of software we use is vulnerable. On top of that, we rarely use Joomla! all by itself, so yes, there might be vulnerable areas. There are also some "gray" areas, e.g. it's not a vulnerability per se that anyone can try to brute force your Super Administrator password, but you want to protect against it. That's where Admin Tools comes into play: it tries to prevent the most common attacks.
Regarding the registration page, it depends on your site. One easy way is to go to your site's Global Configuration and disallow user registration. Obviously, if your site relies on users being able to self-register, you can't do that. Since that functionality went under extreme scrutiny for the 2.5.4 release, I doubt that there will be another vulnerability regarding the user registration feature for a while and I'd recommend enabling it, as long as you have Joomla! 2.5.4 or later.
Admin Tools does have a log, of course! You can't have active security without some good ol' fashioned log searching. Admin Tools' log can be found at Admin Tools, Web Application Firewall, Security Exceptions Log. Please take a look at the documentation for more information. Joking aside, you should read the documentation. Admin Tools is a power tool, but the only way to really make good use of it is to understand how and why it works. If you read the documentation you'll understand what I mean :)
Regarding removing the Joomla! word, it's complicated and I could write at least three chapters explaining why this kind of protection against fingerprinting (that's how it's called) can never be 100% accurate. Even though Admin Tools can remove all instances of Joomla! from your page, don't do it. Really. It's a bad idea. I'd recommend changing the Generator meta tag and enabling the .htaccess Maker protection. Doing that will prevent the most common fingerprinting methods. If someone really knows what he's doing, he can still understand you're using Joomla! and this can't be prevented without breaking the CMS. The same holds true for all CMS out there, including Drupal and WordPress.
Joomla! 1.6 is exactly 0% secure in comparison to Joomla! 2.5.4. There are at least half a dozen known high priority security vulnerabilities fixed since Joomla! 1.6.5. Any one of them can be used to hack your site. After using Admin Tools on it, it will become only 10% as secure as Joomla! 2.5.4. This means that unless you are attacked by the most dumb wannabe hacker in the face of the planet, you're still a sitting duck.
IMHO you don't need to burden your site with too many security extensions. The other major security extensions do pretty much the same things as Admin Tools. Even if you install more than one security extensions you will not get a much better protection for your site. All you'll achieve is spending more money, make your site slower (security extensions do have a slight performance impact) and make issues undebuggable (if I can pretend that's a real word). What I mean with the last point is that if you have, say, three security extensions on your site and something doesn't work how can you know which security extension(s) cause this and work around it? I can't know that, so if you ask me for support I will not be able to provide it, as it will be impossible for me to know if you need support with Admin Tools or something else (not to mention it will be impossible for me to test a solution on your site and be certain that another security extension doesn't get in the way).
Nicholas K. Dionysopoulos
Lead Developer and Director
🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!
