I have said for a very long time Ask should be the default, but that too can be an issue as the user will get asked the question right away 'what to do.' Many will have no answer to make an informed decision, which is I believe why avast have chosen Auto as the lessor of the two.
With Auto, initially it will be investigated and run sandboxed, if set on Ask there is the possibility that the user selects Open Normally, if that decision is wrong it could be letting an unknown malware run.
So it isn't so clear cut which is best, I know I would say Ask, but for the average user that brings its own issue.