> most systems have the same username and passwords (customers never change the defaults)

That is horrifying and 100% on your dev team. You should not ship default credentials, instead require unique creds to be set at install. Ship an update which required default creds to be changed.

Who do you think you are, Cisco?