Maybe I am alone on this, but I prefer to make the hacker try harder without
inviting them inside.
Eric,
The property of well known address is that, well, they are well known. So if
a vendor start to use fe80::1, I guess most vendors will use it and there is
little guesswork to be done.
Now, with service discovery, I would expect that as soon as the device is
configured the first time, some king of security will be put in place, if
only using a password. This can be done before the ISP connection is up. If
the user decide not to use a passwd or any other form of security, well,
this is a different issue.
I have seen this discovery being implemented already: simply try to
configure an Apple airport.