Fresh install of beta leaves well known bootstrap admin account

Description

When creating a brand new instance of v2.0.7 beta, I could log in with admin/admin. It did not require me to then change the password. Expected behaviour

I expected to be forced to set a new secure password What is happening instead?

It allowed to use the system normally.

How to reproduce?

Install a fresh system (used the beta tagged container: I think it's 2.0.7, can't find anywhere in the UI that lists the version)

I also don't see a way to actually expire a password for a user.