Given how often this happens, not having a default password and forcing users to set it should be a standard practice these days. Relying on administrators of the instance doing the right thing obviously keeps failing, thus an option to do the wrong thing should be removed completely.
Developers are good at copy/pasting commands.
docker
We're not an US Agency, but it seems those things happen eventually.