Setting it in the web interface should be safe if you use a direct Ethernet cable between your laptop and the device for configuring the password. But if you instead plug the device into your switch, are you really sure there is not a single potentially malicious device on your LAN? Somehow proving that you have physical access to the device is the desired level of security, and using the serial port seems like the closest you get using this hardware. Something based on buttons on the device could possibly be better, but this particular hardware looks like the reset button is the only button present. The console port looks like a USB-C port. Does that mean this device has a built in USB to serial adapter? That’s probably convenient if you want to access the port from a laptop. But it might make it problematic if you are using one of those remote console devices with Ethernet and several serial ports.