I had a wee wonder whether this could in itself be exploitable -- whether some other compromise could end up dropping a file in /boot/ssh and then waiting for a

I had a wee wonder whether this could in itself be exploitable -- whether some other compromise could end up dropping a file in /boot/ssh and then waiting for a reboot to enable persistence. I guess by that point, however, you've probably already lost so that threat model likely doesn't matter. I'm interested in whether this will make a meaningful difference, however. It probably would have been nicer if Raspbian required users to put a root password into /boot/password or similar, and then deleted that file on boot -- or mandated that users change their password on first login. My concern with this is that I suspect most tinkerers will press the "make it work" button, drop /boot/ssh in, and never bother changing the password.