Project BISmark aims to measure broadband service by recording and reporting on service using OpenWRT-based router firmware (software licensing unclear, no LICENSE or COPYING files in the repos) with results published publicly. Their privacy statement highlights that they collect only service information, not network traffic. However their Participant Notices also includes the following statement:
BISmark Remote Access Statement
To control the measurement experiments run on participants' BISmark devices, as well as to upgrade and troubleshoot devices when they are installed in participants' homes, the BISmark routers have remote access capabilities. Authorized members of the BISmark team have the capability to execute scripts and obtain shell access on the BISmark router installed in your home. These capabilities will only be used for controlling measurement scripts and for performing maintenance on your BISmark router.
Given that a BISmark researcher could log in to my router, could they (attempt to) access other machines on my network?