Don't underestimate people's laziness. I've seen Pis with the default password being setup in internal networks and then exposed to the Internet (either via an actual public IP or via a port forwarding) without any change. There was even at least one case where the use left the thing like that after my remarks about security, saying it was just a temporary setup and that nobody would find it anyway...