I wonder about raspberry pi - it's the image you download that has the known user and password.
It might mean that you can't sell one with a pre-imaged, pre-installed sdcard unless you customised the image.
It's very easy to remove that and ask for a password on first boot. It could literally be one line in a shell script. They could put it in a text menu if they want to get fancy.
More professional (non-hobby) RP based devices probably aren't using stock vanilla Raspbian anyway.