Hacker News Reader

You could set it up using the serial console then.

Does the average Raspberry Pi purchaser have the hardware or knowledge to connect a serial console?

I almost never do. I ssh into it.

To be fair, I had a Pi2 and used it to watch videos but it died and my tablet or my TV+USB key are more convenient to use now. I guess some people would use a Chromecast instead.

If I remember correctly, raspi-config starts when you first login and that's a big hint to go and change the password. But after that there's something that nags you to change it but doesn't force you. I think this is entirely reasonable.