Agreed, but it's just like a login or screensaver password, it doesn't encrypt anything and is meant (or at least should be seen only as) to repel annoying behaviors from unscrupulous people.

Actually, even if the password was stronger i doubt it would secure more of the device as it's probably possible to enable some R&D mode... But like any computer, physical access is hard to secure if you don't have full encryption on.

Of course, if it had full root encryption with only a 1% battery drain hit and with the help of a specific co-processor, i'd be much more happy i guess, but that won't happen anytime soon.

And I'd rather be able to recover my password through ssh (which does ask a password too!) than have to send the device back for some security by obscurity proprietary solution from them. :-)