The article doesn't disclose the value of "sys.rzadmin.password", but this writeup from 2022 does:

Spoiler: it's "rzadmin". And it looks like there are a bunch of other goodies in the firmware, too.

Sounds like a convenience feature for a dev that they forgot to remove before distribution, since it's this poorly hidden.

In computer security, never attribute to ignorance that which is adequately explained by malice.

You’ve got the saying backwards:

“Never attribute to malice that which is adequately explained by stupidity.”

Pretty sure the point was to invert it. :)

	▲	hnlmorg 11 minutes ago \| parent [-]
		Yes, I got their point. My point is that’s the opposite of reality.

That backdoor is so up front about it. We might as well call it a frontdoor.