You have to explicitly turn on SSH access, and each device has its own unique SSH password which is only accessible from the device itself. It's not a set of generic admin/admin creds.

So...not out of the box.

Do you have SSH-exploiting self-replicating worms running on your main network?

One would hope not, but it makes connecting to less trusted networks much more risky than it needs to be. And I'm sure that's something users will regularly do.

Software updates are infrequent and they certainly aren't pushing out standalone security errata that I've seen.

I don't see this as a fair point when the option is disabled by default, like in this case. If you enabled it, then you should be aware of the risks of it, if you connect it to untrusted networks.