Or ship every new device with a different randomly generated 10+ character password and writing it on the device's label just like the MAC address. I agree you would need physical access to the device to gain access to it but you can always change the password to avoid this. There are vendors that already do this with the WiFi key.