When I setup a new server or a temporary account, my usual workflow would be simply generate a new random password locally from my password manager, before cons

When I setup a new server or a temporary account, my usual workflow would be simply generate a new random password locally from my password manager, before considering proper authentication. A few routers at my home with public Internet access are still password-only, and I don't see a big problem. But I have to agree with you, the suggestion "use strong password" itself is prone to failures, thus bad, and should be avoided.