Comment by stephen_g

> Personalizing / customizing per device always introduces a huge amount of complexity (and thus cost)

For a hardware product mass produced like this, they should already have a custom label that has the unique serial number on it which is also programmed into each device, so they should already have the infrastructure to do that (potentially as part of automated board testing/flashing).

Adding a randomly generated password is hardly more work once you have the ability to do that.