it must be your supplier, i've never had a hik dvr from dynamic, adi or ezcctv that didn't come inactive ready for a fresh password, but i did have a couple from cctv direct that had clearly been returns, the cameras had even been named till, shop left etc.
if you tftp new firmware on them the password will reset to inactive, just be sure to use the right firmware as it doesn't do any sanity checking that way, it will let you apply a wrong firmare but it wont like it.