For someone looking to cause trouble using other people's routers, I can't imagine it's terribly difficult to run a Shodan search and attempt login with default

For someone looking to cause trouble using other people's routers, I can't imagine it's terribly difficult to run a Shodan search and attempt login with default credentials. The whole thing can be scripted and once you have a list of vulnerable devices, you upload the modified firmware and you own the router. I don't do this sort of thing but I was under the impression that it's pretty common (hence the importance of setting strong passwords on any device accessible to WAN).