I would also point out that many “devices” have two sets of “credentials”.
The best example of this would be your homes “router”.
One set of credentials is the SSID (the name the device broadcasts that you connect to) and it’s associated password. IE the WiFi password.
The second is the “username” and password used to enter the administration portal of the router.
From my experience as the unpaid computer consultant to family and friends
is that many homeowners subscribe to their ISP of choice, a tech shows up to install the “box”. Many of the techs plug the hardware in, tell the homeowner what the SSID and password are and leave or the homeowner sets it up themselves but isn’t aware of the admin portal or how to access it. Even if they do know they are reluctant to change anything as they might cause their new internet connection to fail.
In my opinion all preconfigured credentials should be changed on day one, after all in the example I give the tech knows what they are!