If I remember correctly, raspi-config starts when you first login and that's a big hint to go and change the password. But after that there's something that nags you to change it but doesn't force you. I think this is entirely reasonable.