I'm sure it happens but it's hard for me to imagine someone knowledgeable enough to port forward 22 and possibly other ports across their NAT to a Raspberry Pi but not knowledgable enough to realize that enabling themselves to access the Pi over the Internet with the default username and password also enables the same ability for everyone else.