ISP sent a message telling that they've detected some bot network characteristic traffic from a router's IP address. Recommended countermeasures have already been taken, i. e. connected laptop's malware scan, router factory reset, router's admin credentials changed (from default) and router firmware updated.
I want to further understand how could the router have been compromised. I thought changing the default admin credentials doesn't matter as long as the network security key remains a secret since you can't connect to the network and therefore access the admin login page without the security key. Apparently, this is incorrect.
Here's what I assume happened: The router in question is plugged into a wall, connecting it via an ethernet cable to some wider area network. In this wider network there is some other machine running malware that scans connected routers, can access their admin login panels without network security key (because it's physically connected), and then try default credentials
admin:admin at any router. After finding a fresh router whose owner didn't bother changing the default credentials after falsely assuming that network security key would be sufficient protection, the malware somehow establishes this detected "bot network characteristic traffic" from the router's address.
Am I on the right path? If not, what else likely could have happened? What did I get wrong?