> admin/admin is not great security hygiene but you’ve reduced most of the risk by airgapping.

admin/admin is on a post-it stuck to the monitor because everyone we hire is perfectly capable of rooting a machine they have physical access to.

Yeah, but deliberately rooting a machine you have no business touching means you are instantly getting fired.

Having an actual password prevents people "borrowing" a key to the equipment broom closet from "optimizing" some config values they really shouldn't be messing around with.