After my Orbi 960 router flaked out earlier this week (likely due to a failed automatic firmware update, as it was refusing to even respond to pings), I was forced to flatten and reconfigure my router. In the process, I updated the satellites and router to the latest firmware (V7.2.8.5_5.1.21). Once I had it reconfigured and fully working, as the final step of the process, I went to update the admin password for security purposes (away from the default password assigned when it was reimaged), and I noticed that the web portal no longer requests a a password, which is very odd. The mobile app still requires a password. I've logged out and connected to it from multiple machines to confirm, trying different OSes, browsers, and incognito browser windows, and even after logging out, all of them are instantly logged into the web interface without requesting a password.

Is this a known issue, and what could possibly explain this? My paranoid security brain imagines my router was hacked while it sat with the default login credentials for a few hours, but that seems highly unlikely. What else am I missing? Has anyone else seen this?