Hardcoded passwords are always wrong – they are equivalent to implanting a global backdoor and hoping no one will find it.
Source: nakedsecurity.sophos.com