Thankfully this isn’t allowed for new devices being sold in the EU anymore. They are required to have a per-device individual password now. Hopefully this effectively causes the practice to at least become much less common globally. After all, if you’ve setup the needed manufacturing steps, there’s little sense in skipping them depending on a target region.