If this was just unsecured, internet facing routers then your point would make sense. However, in this case there is a vulnerability in the WebUI platform that allows unauthenticated users to make admin accounts to the system. That is absolutely Cisco’s fault