I remember stories of the default password being a weak hash of the SSID. And when those are "ISPNAME-4DIGITS", it's not too hard to collect them all.

Sometimes, they can be retrieved from the MAC address as well. So it's just the illusion of security for most.