>the "ssh" file hack doesn't set up SSH keys and disable password auth, or at least change the default password.

It's a quick an dirty hack to enable you to SSH on the local network & avoid finding a screen & keyboard.

SSH keys you can add later...presumably your local net can keep the bad guys out for the 30 mins it takes.