I (could have) hacked water heaters - the “S” in IoT stands for “security”?

Recently got a new water heater... and found credentials that allowed me to change settings on ANY water heater from that brand.