Yes, download the T-Mobile app on your phone/tablet. Once you are setup it will direct you to change your towers name and password. (at least mine did)

Yes you are correct but all someone has to do is unplug and reset your modem and they can use the original passwords that are on the modem to log back in... It's a bad choice on their part where they were trying to be smart in case you forget your password but not good for shared space where others can access the modem. 

Well, nothing is going to be secure if other people have physical access to your device.