A friend is using my old DIR-655. I would like to warn them, but I need to understand this better first. Am I correct that this allows administrator access to

A friend is using my old DIR-655. I would like to warn them, but I need to understand this better first. Am I correct that this allows administrator access to the router, but requires connecting to the router's network (either via having the WiFi password or having physical access)? IIRC, the DIR-655 is also stuck on WPA2, which was broken, so the WiFi password doesn't offer any protection either. In which case, anyone within range of the access point could access the admin panel. On one hand, this sucks because aside from these vulnerabilities, the DIR-655 works fine. On the other hand, I think I bought it over a decade ago.