but not all companies have a security hat to wear.

This is the barest of minimalistic security. It’s a router. You don’t allow external admin access to the router. Period. End of story.