So when the device is deployed insecurely, it broadcasts itself to the public to invite a takeover? Why wouldn't it just decline to operate at all until the password is set?
The troll thing to do is set a password if you find one of them in the wild.
This truly is the right way to handle PSK auth. The "UX" for it isn't as nice as some people would like though.