Never changing the password for distributor_admin for local instance only?
I posted a general question at security.stackexchange If no one knows a password, is there a reason to change it?  as of this writing it has 3 answers. 

The consensus is, two part


If you know that the password can not have been compromised there is no reason to change it.
But what if it was compromised and you don't know it.  By not changing you leave your system open forever. 


Examples:


someone who was able to access the machine from an unknown vulnerability will have unlimited access to the system, forever.
If there is evidence, or at least a reasonable assumpion, that the secret has been compromised. In that case, change it immediately
If an admin who could recover (or change) the password either moves to another role or leaves the company, the password should be changed immediately thereafter.



  Is there a good reason to change the password for distributor_admin for local instance only?


Yes, if you can change it, someone else can change it and have eternal access. If you have a password changing policy 'distributor_admin' should be included in that policy.