Getting rid of default passwords would be a start. But default passwords are not the only problem with these devices. Apart from this obvious problem we have undocumented accounts users cannot even change, backdoors which might be deliberately placed or just accidently left in for debugging, vulnerabilities against CSRF, XSS, DNS hijacking and much more.
A major reason for this mess are vendors which don't know much about security and don't really care and users which don't know and don't care either and also like to have the cheapest device possible. And as long as nobody causing this problem will be held accountable for this mess and will feel the harm they do to others it will not get better.
Making vendors feel the problem can actually be very effective. For example the influential german computer magazine c't did a lot of tests of routers in the last years and probably also thanks to their successful public shaming of vendors with insecure settings now probably most routers sold in Germany enforce changing of the access credentials on first use or don't use default passwords at all and also take care of various other security problems.