Honestly kinda wild you can’t imagine this person, because when I was in my teens it was me.

You don’t care about security or don’t understand the implications, and why would you!? You’re having fun!

Fun is the deal. If you focus on the fun path you will jump right past any non fun, which is security.

Think about smart kids who get hurt. Were they capable of preventing the injury? Definitely. We’re they having fun? Absolutely. Fun wins every time.

I think that sounds extremely likely. You know exactly how the average tinkerer loves to follow tutorials that they don't fully understand.

"Access your raspberry pi from the internet" probably doesn't sound to the layman like anyone can access your raspberry pi with zero effort

I dunno, Im sure there are lots of people who have opened things up so their xbox/ps/whatever works properly (or just enabled DMZ for everything) - and just added the Pi as they would do for those.

> but it's hard for me to imagine someone knowledgeable enough to port forward 22...

I was supposed to be a "knowledgeable" IT expert, but back in the 90's I managed to open-relay my company's mail server...

I did so many and different walks of shame that week.

Don't underestimate people's laziness. I've seen Pis with the default password being setup in internal networks and then exposed to the Internet (either via an actual public IP or via a port forwarding) without any change. There was even at least one case where the use left the thing like that after my remarks about security, saying it was just a temporary setup and that nobody would find it anyway...

Also don't forget the classic case of people simply forgetting that they set something up, likely originally for some very temporary purpose.

Automatic upnp is a thing