I think that any device which has this problem is basically bricked, from the average user's point of view. Most IoT gear just isn't worth the effort to try to

I think that any device which has this problem is basically bricked, from the average user's point of view. Most IoT gear just isn't worth the effort to try to fix. The only (partial) solution I can imagine is someone creating an open-source software for resetting the password to a non-standard setting, then evangelizing the standard. There are a few issues with this, and it would require adding some standard interface (USB or other) to every such device.