Actually I did find how to do this....
edit /etc/systemd/system/[email protected]
ExecStart=-/sbin/agetty --autologin pi --noclear %I $TERM
ExecStart=-/sbin/agetty %I $TERM
Now your PI 3 will boot and have a secure console login.
NOTE: The screen doesn't clear like a normal debian login and I can't figure out how to do that without editing rc.local and adding a clear command so it's just cosmetic by product for now.