Looks to me that these are all discount vendors. I didn't even know Realtek made their own consumer devices.
That they were all using the same or a variation of the same firmware shows that the problem isn't maliciousness but carelessness. Someone writes a reference implementation that happens to have a hard-coded username as a debugging option. It may even have come with a note warning you that this needed to be changed before being put in the final product. But in the rush to a product to market as fast and as cheap as possible, they forego any modification to the firmware beyond branding and push it out bugs, backdoors, and all.
I think it's a stretch to say these are "major" vendors. I've only seen TrendNet in the wild and usually because someone is complaining about their internet not working well and I say, "Yeah, that's not a good router. You should buy another one." You get what you pay for.
Of course if a truly malicious actor wanted to place a backdoor into a router on purpose, I expect it'd be someplace other than the flash firmware that can be easily overwritten.
That they were all using the same or a variation of the same firmware shows that the problem isn't maliciousness but carelessness. Someone writes a reference implementation that happens to have a hard-coded username as a debugging option. It may even have come with a note warning you that this needed to be changed before being put in the final product. But in the rush to a product to market as fast and as cheap as possible, they forego any modification to the firmware beyond branding and push it out bugs, backdoors, and all.
I think it's a stretch to say these are "major" vendors. I've only seen TrendNet in the wild and usually because someone is complaining about their internet not working well and I say, "Yeah, that's not a good router. You should buy another one." You get what you pay for.
Of course if a truly malicious actor wanted to place a backdoor into a router on purpose, I expect it'd be someplace other than the flash firmware that can be easily overwritten.