I have an Arris modem. Is there a way to mitigate this risk short of buying a new modem?
With mistakes like that, and three layers of backdoors, I'm half expecting discoveries of hardware backdoors next ...
But if you ssh and have root access, then you should be able to change the password. As well as edit a startup script to move/delete the backdoor files.
Try it at your own risk.
Many can, however, be configured as a bridge, which turns the device into just a converter between physical mediums. You now need another device to route and act as your gateway. In that setup you shouldn't be able to find it with an IP connection scan, because it doesn't have one.
Not in my experience. The default modem provided by both Comcast and Knology (who is -I guess- now WOW!) is (or was, in the case of Knology) a bridge device that requires you to provide your own router. You have to ask for a modem that's also a router to get something that's not a bridge.
That doesn't mean that the modem doesn't have an IP address, mind. AIUI, on Comcast's network the modem gets an IPv6 address so that they can do network management stuff to it.