It is about as sensible a design as you could come up with while still tying the access to be gated by the manufacturer. I still don't really get why it's done this way: the stated reason of security against a previous owner of the system doesn't make sense: this can more easily be accomplished by being able to reset the password.

(As an aside, assuming the system gets its time from NTP, I wonder if you could extend a token's access time indefinitely by returning a looping timestamp from a local server)