The Bedrock repository contains three default mu-plugins:
Why are these part of the repository, instead of being defined in composer.json and loaded as mu-plugin's through the installer-paths method described in the docs? Just curious as to why things are the way they are. 
Probably because they’re all very small and the overhead of creating separate packages for them didn’t seem worth it? IIRC they also provide functionality necessary for Bedrock to work the way it does (esp. the autoloader plugin) so it makes sense to include them as part of Bedrock rather than separate packages.
If it bothers you I don’t think there’s anything preventing you from extracting them to your own packages and installing them through Composer.
Thanks for your quick and accurate response, greatly appreciated.
Having bedrock-autoloader.php directly in mu-plugins does indeed make sense… realised that shortly after asking the question 
Another mystery solved!