I see it as somewhere in-between. It is one more thing on a long list of things that is easy to forget when setting up a new machine. I do stuff related to this for a living and miss things sometimes[1].

It is not unreasonable for someone to expect setting up a BIOS password to mean all management functions should require it. Unfortunately, reality is such that, depending on platform, the answer will be, "oh, you meant those management functions, too. Yeah, no, you also have to stick a password there."

So yes, this falls under "documented behavior." It also falls under "unfriendly, annoying complexity that shouldn't be foisted on non-professional users", and possibly worse.

It all goes back to the ME being forced down everyone's throats. It means continued insecurity everywhere; the same deal with AMD means no choice. I'd love to see a foreign competitor - at least then one would be able to choose who sniffs their panties.

[1] Most recently, with a home storage system. I built it some time back, and later, after moving stuff around, switched the network port I had it plugged into. I monitor my own network, including IP sweeps, which is the only reason I noticed the SuperMicro motherboard had grabbed a second IP address and was running a ME webapp with a default password.

Now, on one hand, I should have read the manual. Building a machine from components requires a certain degree of paying attention, and I didn't. On the other hand, this is an absurd default. In 2018, no system should ship out of the box with a giant Root Me Please! welcome mat.