Very likely they shipped with an ADMIN/ADMIN username/password and nobody changed it. Because who would want to break in to a freezer, right? It's not like there's bitcoin in there.

We've been telling people for years that naive threat modeling was going to bite everybody one day. And finally, here we are.

Approximately. These models had been deprecated by 5 or 10 years, and a successor model last year had a software update issued because they had a secret "password of the day" that allowed you to use the date as the admin password.