A classic case of convenience over security. Hard-coded credentials make maintenance easy, especially for ISPs managing many routers - but that's akin to prison wardens only putting one lock on all cells because carrying a bunch of keys around is an inconvenience.