Right - and as I probably don't have to explain to you (given that you have a PGP key in your bio!), these sorts of control systems are often sitting ducks even if the default admin password isn't publicly available to those who know how to do an advanced search.
Many of them will readily succumb to an automated brute force attack using one of the several password-cracking tools packaged with Kali, BlackArch etc.
'Cos they're not indexed by regular search engines, so the security is lax. 🫣