I agree with everything you said. The defaults are just wrong, it should not have any web server at all with a default password, that's an easy software fix.