While I generally agree, there are two problems with the scan example. First, a survey on twitter isn't exactly good data to base an opinion on. Second, even if the majority would scan the defaults, you still don't know the likelihood of someone doing a targeted attack and scanning the defaults. Such a survey is pretty impossible because you would need data of real attacks.
