I don't think they should be fined, but they should be required to fix security vulnerabilities. Default passwords are a vulnerability, and defective by design

I don't think they should be fined, but they should be required to fix security vulnerabilities. Default passwords are a vulnerability, and defective by design is not an excuse... My Netgear router came with a secure unique password printed on a card, an internal-only admin panel, and UPnP disabled by default. It's not hard.