\Drupal\Core\Field\Plugin\Field\FieldType\EntityReferenceItem::onDependencyRemoval() sets auto_create to an invalid data type

So the reason that this is not casted to a Boolean is that we have special logic around null values \Drupal\Core\Config\StorableConfigBase::castValue() in specifically:

    if (is_scalar($value) || $value === NULL) {
      if ($element && $element instanceof PrimitiveInterface) {
        // Special handling for integers and floats since the configuration
        // system is primarily concerned with saving values from the Form API
        // we have to special case the meaning of an empty string for numeric
        // types. In PHP this would be casted to a 0 but for the purposes of
        // configuration we need to treat this as a NULL.
        $empty_value = $value === '' && ($element instanceof IntegerInterface || $element instanceof FloatInterface);

        if ($value === NULL || $empty_value) {
          $value = NULL;
        }
        else {
          $value = $element->getCastedValue();
        }
      }
    }

So we leave nulls alone. This is a much much wider issue if we want to fix that. I think the current small fix is okay but I'll check for follow-ups about this wider issue of config and nulls. Config schema does have the concept of nullable but funnily enough this is only really supported by sequences and mapping types - even if there places in core where people have added it to scalars.

whoops... @Krzysztof Domański thanks for tidying that up!