The password is randomly generated for each device, yes. And of course the network only becomes available once you connect the device to your WiFi, or via cable to a PC. Once you're connected, you can also change to key-only authentication if you want.
The SSH daemon is Dropbear, and it doesn't seem to be updated though:
Is the password different for every device? Is the ssh daemon updated regularly? Seems like a massive security vulnerability otherwise.