Amen to that. I do some work on the network side of control systems—and default passwords (or no passwords) are rampant, and often recommended under manufacturer guidelines. The last part there is the more worrisome.
Business phone systems are the same. Most manufactures only allow a 4 char password. Now phone systems are being hack left and right; "hackers" (more like organized crime) selling carrier service and the company gets the bill.