@stefano That's so on time! Just got forced to do that. Though, I think I managed to improve slightly upon the method by eliminating the small window where anyone who happens to know the (well-known) root password may ssh into the box. Instead of dd(1)ing the installation image onto the disk, I ran it in qemu:
qemu-system-x86_64 \
\
-cdrom mfsbsd-14.2-RELEASE-amd64.iso \
-drive format=raw,file=/dev/nvme0n1,if=virtio \
-drive format=raw,file=/dev/nvme1n1,if=virtio \
\
-display curses \
-m 8G
And after the installation entered shell, and changed rc.conf like so:
ifconfig_DEFAULT="DHCP"
#ifconfig_em0="DHCP"
#ifconfig_em0_ipv6="inet6 accept_rtadv"