I think a LOT of this can be distilled down to a pessimistic anecdote...that doesn't mean they're not relevant. Like how the 3rd part vendor likes to make pass

I think a LOT of this can be distilled down to a pessimistic anecdote...that doesn't mean they're not relevant. Like how the 3rd part vendor likes to make passwords like %companyName%%YearOfEngagement%%symbol% and how that might be bad, especially if your NAS admin console is discovered to be internet facing.