Strangely, the article is titled "Weak Passwords", but discusses default/shared passwords. No mention of length, complexity, multi-factor, etc.
Personally, I think that password-strength is the wrong discussion. IoT devices have poor patch availability, little interest in maintenance, and are in places where one does not "care" much about the individual device. With a lifecycle of "run them till they die", our focus really should be on limiting the ability of poorly managed devices to cause damage.
This might be as simple as putting lens caps on cameras and not bugging our own kids. Or, it could extend to requiring manufacturers to advertise the risks as strongly as they advertise the benefits (like the US FDA does with drugs) and requiring recalls when flaws put consumer safety at risk (including loss of privacy).
From a technological perspective, we might consider switches that isolate IoT devices from each other on the home network, routers that are able to limit their Internet access to a curated list of sites and not exposing login/admin pages from untrusted networks. At work, we have technologies capable of doing this, but commoditization, simplification and automation is needed to make these capabilities accessible on $100 home routers.
