When you think about it, the only thing it takes to make any given Moodle install "insecure" is to reveal the admin username and password. And...I'll bet that on most Moodle installs the admin username is "admin".... therefore, the only thing keeping most installs secure is the password.
Ummmmmm . . . for my first install when having a look at Moodle (and numerous other scripts) . . . 3 guesses for my admin username
On the plus side, I only used "admin" for having a quick look at scripts but I have a sneaking suspicion you may be right there on a lot of production sites.
As for passwords, I use the password generator on the right of this page, I'm sure there are lots of generators out there but I have used quite a few of B&Ts scripts from that page.
Harry