To add to @bit_user's remarks, if an attacker manages to get into your pi and run arbitrary code, with the default password, they now have root access. They can run echo 'raspberry' | sudo -S sh that launches a root shell, which they can use to do all the nasty things they can imagine.
Setting...