How secure is Autoprovision implemented with tftp?

Question

Telephony

There is a Yealink phone park (more than 100), they have the AutoProvision function, basically everything is implemented through a TFTP server, the phone sends a request and receives general and individual settings (login and password). How safe is such an implementation? After all, the TFTP protocol does not support authorization and it turns out that anyone can take possession of personal data (login and password) simply by changing the poppy address of the phone.