168
No more 12345: devices with weak passwords to be banned in UK
(www.theguardian.com)
This is a most excellent place for technology news and articles.
I wonder about raspberry pi - it's the image you download that has the known user and password.
It might mean that you can't sell one with a pre-imaged, pre-installed sdcard unless you customised the image.
It's very easy to remove that and ask for a password on first boot. It could literally be one line in a shell script. They could put it in a text menu if they want to get fancy.
More professional (non-hobby) RP based devices probably aren't using stock vanilla Raspbian anyway.
Raspberry pi OS != Raspbian
Those are two completely separate and different OSes.