I agree that better design is imperative. However that is not the situation we are in currently. If you are hired to secure a system and leave the credentials

I agree that better design is imperative. However that is not the situation we are in currently. If you are hired to secure a system and leave the credentials as root:root, you are derelict in your duty. Period. If there is a system with external access, someone set it up. It is the responsibility of whoever setup that system to ensure access controls are in place. The barest minimum of that is to change the default creds to something unguessable.