For product hardware (outside the factory default state), pre-installed software and software that must be installed for the product's intended purposes, any password is unique per product or set by the user; unique passwords are not based on incremental counters, public information, or product identifiers such as serial numbers (unless derived by encryption or keyed hashing accepted as good industry practice), nor otherwise guessable; cryptographic keys, pairing PINs for non-IP protocols and API keys are not treated as passwords.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.