Literally this. I've worked on some audits that included pretty featureful BMS, and no joke, some of those systems could have given real "mission impossible" c

Literally this. I've worked on some audits that included pretty featureful BMS, and no joke, some of those systems could have given real "mission impossible" capabilities to an intruder. Disable alarms? Disable cameras? Unlock doors? All possible through a web control panel that looked like it belonged in the early 2000's with hard coded, undocumented accounts.