Yeah sure – when it's appropriate. I've got a RaspberryPi within armsreach that's still got the stock ARCH-ARM image with it's default login of root:root.
Yeah, I wouldn't deploy it on a public internet exposed network, or give it to someone else who wasn't aware of the implications or consequences of such an insecure machine – but in the privacy of my home network it's just fine.
I assume this guy is the same – he needs some increased safety if he wants to show this thing off in public, but in hs own shed he's got every right to accept risks for himself that are inappropriate for other people.
I've seen equally and much more "dangerous" projects at Burningman – hell, if he gets this running with any sort of reliability, attaching it to a bicycle and riding it around at Burningman would be a _fabulous_ idea!
The computer version of safety is called security. And HN cares a lot about computer security.