Routers should be secure by default, and it should be hard to do something that will make it insecure. The router manufacturers are the supposed experts when it comes to networking, expecting every consumer to even know the risks of exposing their router admin interface to the world is not a reasonable assumption.
I have never seen a router that had its admin page visible to the WAN by default.
I'd wager there's a non-zero percentage of routers which have the modem (or ISP router) plugged into a LAN port.
They should limit vehicle speed to 5mph so I don't hurt myself or others.
I have used many of these routers. Admin access on the wan port is blocked by default and must be enabled by the user.
Of course, both with the car and the router there are good arguments that you should be able to do the dumb thing if you know you need it. If it has to be explicitly enabled after intense warnings, the protective duty (as someone knowing better) can possibly be considered fulfilled - or you can still argue that it should be especially hard to do to block out people who don’t listen to warnings.
These routers were put on the internet on purpose, by people that seem to know what they are doing (universities and businesses), and none seem to have default credentials. Seems reasonable to me.