If you have physical access you can just factory reset the device and onboard it with the normal flow though

That's fair, though at least resetting would indicate that an attack happened. Default passwords and printed passwords can result in undetected attacks, which are arguably worse.