Trustpower KInect ADSL modem - firewall disabled by default

I have just helped a neighbour who has switched to Trustpower Kinect install the ADSL modem that was supplied.

I was rather surprised to see the following:

1 The admin username and password were left at the default

2 uPnP was enabled, and accessible over the internet (see http://upnp-check.rapid7.com/ or http://www.grc.com )

3 The firewall was not enabled, and telnet, SSH, FTP and various other services were exposed.

Am I right to be worried about the level of care that Trustpower are taking with their customers?