Right, I changed the default, and now I ban anyone who tries it.
fail2ban is nice and all, but irrelevant to this post about a default login.
My entire point being that any client that tries a default account should be insta-banned. That’s what I get from this.