There are supposedly several default users set up, per Section 3.1.1 Default Passwords of their documentation (dba, dav, vad, demo, soap, fori), but dba and dav are the critical ones to change. Note: I don't actually see the other users under the Ubuntu Xenial virtuoso package (version 6.1.6+repack-0ubuntu5)
That page also has the isql syntax to change the password (only for the logged in user, ie, dba) on the command line:
This can be changed using the Interactive SQL utility. When started without parameters, the ISQL tries to log on as dba with the default password. The SQL statement to change a user's password is:
set password <old password> <new password>
The password is an identifier, so take care to use proper quotation.