As you suspect, there are many implicit assumptions and abuses of language in this terminology.
First, it is not safe to assume that an "automorphic" repn of $G(\mathbb A)$ is literally a repn of that topological group. Sometimes, only the finite-prime groups are allowed to act, and at archimedean places one does not have a group representation, but only a $\mathfrak g,K$-module. A reason to want to be able to talk this way is so that the $K$-finite vectors at archimedean places be preserved, which would fail for a genuine group representation (at least if the archimedean groups were non-compact).
Second, "unitary" in these situations is used very casually, so, no, one should not presume that the action is on a Hilbert space. Indeed, the requisite completion(s) to a Hilbert space might wreck other assumptions about $K_v$-finiteness at both archimedean and finite places. That is, at finite places, the usual sense of "smoothness" would be ruined.
Nevertheless, sometimes there is reason to also be able to refer to the Hilbert-space completion of a pre-unitary repns of groups, as yet-another less-ambiguous isomorphism-class representative.
In any case, no, unitary automorphic repns need not be sub-representations of the space of automorphic forms. The easiest example is the Eisenstein series for $GL(2)$, with parameters making all the local representations unitary. Then these generate everywhere-locally-unitary (or pre-unitary, as you like) repns, but are not subrepresentations, only quotients. This is not a "pathology", any more than is the presence of continuous spectrum in the first place.
It is true that one can try to squirm out of this situation by trying to make "Hilbert integrals"'s integrands behave as well as do genuine sub-objections, but it really doesn't work out.