Every router I've met still runs a firewall that blocks incoming traffic by default IPv6 or no. My guess on this kind of thing would generally be that the infec

Every router I've met still runs a firewall that blocks incoming traffic by default IPv6 or no. My guess on this kind of thing would generally be that the infected computer reacher out to a service controlled by the hacker to establish the shell and the reporter misunderstood, or that the dev connected to a VPN controlled by the attacker, effectively bypassing the firewall, otherwise something is really badly configured on the devs end.