It sounds like they are both inept and indifferent about the running of the business, default passwords are not really that huge of a risk. Not updating systems after a long time is one and keeping the fridges connected to the internet while not spending enough on cyber security is a big risk.