I had a thought today that it might make more sense to reverse the first three options on this step, and assume that most sites will want to be public, allow registration and not require approval. I believe this is the case.
So for most people on this step they will scan the list of enabled settings and confirm that things are as they should be. Those that want can disable settings according to their wishes. On our hosting on the basic plan where sites can only be private and invite only the distinction will be very obvious, and it will make sense to people that to gain access to public and open registration requires an upgrade to the standard or business plans.
@ella what are your thoughts? Would it be worth mocking this up to see how it looks?