Yes, this could happen in theory. The webinterface could be faked by the attacker if she manages to get full control over the router (e.g. rewrite firmware), so that your normal DNS server is displayed on the settings page, while in fact a malicious one is actually used. In theory the attacker could also fake the firmware update function, so that you think you update the firmware but the router is in fact still vulnerable.
However, that would be a quite advanced attack that would have to be tailored for the specific router model, and not something I would normally worry about. But if you are feeling suspicious, do a factory reset.
So can the factory reset be tampered with? Possibly on some router models, if the memory where the original state is saved is writeable. Also, some models might not restore the firmware but only settings leaving infected firmware intact. But again, this would be something out of the ordinary and the average home user should loose any sleep over it.