To prevent people from creating configurations readily available for trivial brute force, we should disallow default passwords at installation and set time. The best way to do it is probably a set-time validator.
We shouldn't prevent configs with those passwords from loading.