I think this change isn't really so much to improve security, as to shift the blame from them, to the owner. And I think I'd do the same thing if I were them.

I think this change isn't really so much to improve security, as to shift the blame from them, to the owner. And I think I'd do the same thing if I were them. Edit: we should remember IPv6 is becoming a real thing, too. If I scan my web logs, see a pi in there, with v6, I might just try to ssh into it as the pi:raspberry user. Maybe I dont even need to decide it's a pi, just try it anyways.