We just started replacing our PLCs. They absolutely were setup with default passwords, but weren't put on the public internet.