I do not have the 2008 NEC. But based on the 2005 version, I would say you cannot put an ATS between the transformer secondary and the first overcurrent device. Item (2) does prohibit it, in my opinion.
The requirement starts with the notion that every conductor must be protected from overcurrent, and the notion that that protection must be at the point of origin of the conductor. The "Tap Rules" give exceptions to this requirement, but they do not abandon the notion of protecting conductors.
In the configuration you described, you have a set of conductors, from the transformer to the ATS, that will not have any overcurrent protection at all. You do not get to take credit for the overcurrent device that is downstream of the conductors that themselves are downstream of the ATS. Item (2) says that the transformer's secondary conductors must land on an overcurrent device. An ATS is not an overcurrent device.
Item (3) is not relevant to the discussion. Sure, you can put the secondary conductors in conduit, and protect them in that fashion. But once they land on the ATS, their identity as "transformer secondary conductors" has ended. So I suppose the enclosure of the ATS will provide some protection for that portion of the secondary conductors that is actually landed within the ATS. But the conductors that leave the ATS, and that eventually are landed on an overcurrent device, are not "transformer secondary conductors," so it doesn't matter how they are protected. At that point, the Tap Rules are no longer appliable.
