Admin password loophole at initial setup

I would like confirmation that indeed the WD Mybook live is vulnerable to anyone connected to my router who can access the drive folders as “admin” if the admin password was not setup beforehand.

After the initial WBL hookup, I found that when I first installed and setup the mobile access apps on my iphone prior to running through the checklist on the Dashboard on my computer, I had full access to my drive as “admin” without any password prompt via the mobile apps. Only when I did this through my computer, then resetted the app on the mobile device, did it ask for the password.
Does this mean anyone only my wireless network had a chance to login into the WD drive between the time I initially turned on the machine and set the admin password???
I recently purchased this product and nowhere in the setup did it say I needed to urgently setup an admin password through the dashboard before I do anything else. Could someone set me straight here?

Thanks

Short answer; Yes. 

Might as well change the Root password while you are at it.

But yes, this is not just WD, plenty of hardware might or not, ask to change passwords or default passwords.

I do make it a habit to be step #1 for any hardware I purchase, whether it asks or not.