It is common for public APNs to use shared credentials - nearly all mobile networks in the UK use the same credentials across all phones (see here for an example).
In M2M applications such as intruder alarm signalling, remote plant monitoring and smart metering, it is common for private APNs to be used instead of the network wide APNs used by phones. I am not sure what the motivation is behind the use of a private APN over a public APN (this previous question doesn't provide much insight)
The use of private vs public APNs is frequently pitched in marketing material as being more secure. Most of these same systems have no additional security (e.g. using a VPN, HTTPS or otherwise) and rely of the security of the GSM/GPRS communication channel.
In addition to this, for the systems I have been reverse engineering, I have found that they all use the same APN credentials across all devices. For example, all the usernames are 'triplecomgprs' and all the passwords are 'Q87363546'.
What are the security implications of all devices using the same credentials for the APN?