From my understanding it's the contrary. The success of Stuxnet relied on the fact that siemens recommended to not change the default passwords as it could affe

From my understanding it's the contrary. The success of Stuxnet relied on the fact that siemens recommended to not change the default passwords as it could affect the operations of critical infrastructure, which is not exactly what I would call defense in depth. Modern defense in depth would require the use of 2FA for manual access (in addition to strong passwords).