The password is randomly generated for each device, yes. And of course the network only becomes available once you connect the device to your WiFi, or via cable to a PC. Once you're connected, you can also change to key-only authentication if you want.

The SSH daemon is Dropbear, and it doesn't seem to be updated though:

> reMarkable: ~/ dropbear -V

> Dropbear v2016.72