eapol_version=1 required for OS X clients?

[Eric Volker <evolker@gmail.com>]

I am in the process of setting up a AP using Ubuntu 9.10, a Broadcom
BCM4318 and hostapd. I've run into an issue getting OS X clients to
associate with the access point. Once I had configured hostapd.conf
correctly, Windows and Linux clients were able to associate with the AP
and use it as a router. OS X clients, however, would not associate and
I'd see messages in the log that said "Deassociated due to inactivity."
After wrestling with that for a few days, I found a reference to someone
setting the EAP version to 1 to allow his iBook to connect. Sure enough,
setting eapol_version=1 in hostapd.conf resolved the issue and allowed
all OS X clients to connect (including a Leopard laptop, a Snow Leopard
iMac and an iPhone 3G.) However, this brings up several questions:

Is EAP version 1 secure?

In light of this issue, why is version 2 default? Is there any way to
negotiate the version level? Which version do off-the-shelf consumer
routers use?

Based on the comments in hostapd.conf, EAP only seems to be used for
802.1X authentication. I'm using WPA/WPA2 (wpa=3) Personal
authentication, so why does the EAP version matter?

Why is an OS as recent as Snow Leopard (10.6) using a protocol version
that the hostapd.conf comments imply is outdated?

Thanks,

Eric Volker