I'm saying much the same thing as others, but this really could be a legal concern for you (I'm not a lawyer). In the UK (*) one relevant act is the Computer Misuse Act 1990 which says right at the start:
1 Unauthorised access to computer material.
(1)A person is guilty of an offence if—
(a)he causes a computer to perform any function with intent to secure
access to any program or data held in any computer
(b)the access he intends to secure [F2, or to enable to be secured,]
is unauthorised; and
(c)he knows at the time when he causes the computer to perform the
function that that is the case.
i.e. if you so much as try to access anything that you know you shouldn't.
Subsection 2 says it doesn't matter what computer, what data, or what kind of data, nothing makes it OK.
Subsection 3 says:
(3)A person guilty of an offence under this section shall be liable—
(a)on summary conviction in England and Wales, to imprisonment for a
term not exceeding 12 months or to a fine not exceeding the statutory
maximum or to both;
And then section 2 of the act says Unauthorised access with intent to commit or facilitate commission of further offences. - you committed an act of unauthorized access (gaining router access) so that you could commit another act of unauthorized access (wifi access).
In one of your comments, you say
no harm meant to be done
But Section 3 of the act is Unauthorised acts with intent to impair, or with recklessness as to impairing, operation of computer, etc - even if you don't intend harm, if you act recklessly, that's enough. Joining an unsecured, unknown, unauthorized, personal device (phone) to the company network 'could' put them at risk of all kinds of cryptolocker style blah blah.
I can strongly doubt that this will apply in force to someone in a small business accessing a router, but if they want to argue it, you've taken a temporary job, broken into their network, their email, their domain / website hosting, carelessly put their network and therefore their company operation at risk, and who knows what theft, blackmail, extortion or damage you were planning to commit.
And what's worse, they don't understand IT, they aren't interested in how much fun it is or how curious it is, or how serious or trivial your actions were, if they get the wrong end of the stick it won't look good for you.
Should I tell my boss their passwords are too bad?
Yes, you should. But don't unless you have reason to think they will take it well. And they should care. But they don't. And it's not your company and not your problem. If they show interest, suggest why (in principle) stored browser passwords are risky, or shared accounts are risky, or simple passwords are risky.
If there is no backup, encourage them to have backups. "Hi, I was reading this news item about GitLab almost losing 300Gb of data and it made me think we don't have good backups here - we could set one up for $xyz, what do you reckon?"
(*) Other jurisdictions are available.