I think what Cisco is trying to solve is to give users the possibility to connect to the device over a secure connection in case a user has no access to a signed certificate by an authority.

So the user must still connect the self-signed certificate when connecting to the device (over ssh for example).

So in this case the user generates the certificate and also accepts it.

By the way, most ssh clients will tell you if a certificate changed. So the moment your self-signed certificate is compromised you will know.