There are many ways, even if WAN-side Management is disabled, to take over these routers from the WAN side. E.g. [1, 2] There are also vulnerabilities in the auto-provisioning protocols used by the modems that can give the attacker an entry-point. [3]
This is just the tip of the iceberg from 10 minutes of Googling. I also recall there was some technique where an attacker could reflect attack traffic through a browser and back into the router, so if you knew the router IP and user/pass you could compromise it by getting the user to visit a malicious or drive-by-hacked site.... but I couldn't find a link for that one.
ISP's that want to remotely manage their CPE, ie. reboot remotely, adjust routes, etc.
Obviously these should be locked to only respond to designated control IP's that originate from the ISP, and default user/passwords should be changed...far too often I've seen corps use a non-default user/pass but instead switched to something different... but only that every single device they deploy has the same exact user/pass on it.
I have seen smaller ISPs use something similar to admin/c0mcast on every single device while using equipment too cheap to include an access list for remote management.
There has been about handful of ways to coax all common UPnP implementations to give you LAN access, except for the all the obvious ways if you can get the victim to view a web page. Don't rely on it for security.
