You're right that default credentials should have gone away a decade ago. From my experience with security cameras, default credentials were the norm ~5 years ago and now most prompt you to create a unique password. That industry typically lags slightly in infosec best practices. I would expect routers to require a higher level of security.
He needs a bike with like 1000 gears