And yes its a mess. Folks resist using real security on their phone or desktop. Imaging an embedded device they buy and want to forget about. They sure don't want any passwords or keys that they'll promptly forget! How many times have I reset my router to factory defaults because, who knows what the admin password is I set two years ago and never used since?

I've put security into devices, and had the client want it taken out. Because their installers find it onerous. And, 'nobody is going to attack my pool pump controller!'