The above picture is Brian Krebs responding with advice about protecting yourself from the IoT hacks. It's common advice given for protecting IoT devices from attacks like the Mirai botnet.
My question is, what does it mean? Supposedly the biggest category of devices compromised were webcams and DVR boxes. What does it mean to "change the password" of a DVR box? A webcam? Or any other IoT device (a coffee-maker password?) If I have a device that uses UPnP, where is its "password"? Those devices just plug in, and work. Never seen a coffee pot ask for credentials before.