I owned Edgerouter X long time ago but if I remember correctly, the admin interface is not open to WAN by default. So people changed that setting but left root password unchanged?
> DOJ removed Russian malware from routers in US homes and businesses
So they still have root on those ? /s
actually they and others are disturbingly familiar with the usage of this malware, and employed its features to enter these compomised routers and disable the malware