It’s very easy to remove that and ask for a password on first boot. It could literally be one line in a shell script. They could put it in a text menu if they want to get fancy.

More professional (non-hobby) RP based devices probably aren’t using stock vanilla Raspbian anyway.