What lessons can be learned from the iPhone worms?

I'd guess that Apple has some kind of security checklist containing stuff like "are network services listening on only the necessary interfaces?", "are passwords stored encrypted?" or "is there a patch process documented in case a security vulnerability is found?". I'd also guess that every product they ship has to be checked for this checklist. I'd also guess this checklist would contain "are there any default passwords on the system?".

If they don't have such checklist or it doesn't contain "are there any default passwords on the system?" or they don't care - that doesn't look well for their other products. I don't think it would be that complicated to not have a root password, so it wouldn't be possible to login at all as root.