These are the retail standard AR Drones with their own Wifi APs and telnetd enabled. It's not the organizers job to secure them. Would you expect the Defcon organizers to do the same for the attendees?