I bought my last batch of Dell machines in 2017 (so, 5 years? wow), and they had randomised passwords.

But yes, some providers put the BMC on the internet because it's easier, a provider I used once did this and I was quite displeased as iDRAC's are quite weak and suffer under the weight of bot-spam. -- even if there were no security issues.