I think this should be reported to MCMC and MYCERT.

Didn't say they will take action. But there must be a documented report made in case for future reference.

And MYCERT is supposed to:

What happens if you reset the router back to factory defaults? Will this "hidden" account remain? Will it reset the password for the account? Will the account still have remote management enabled after a reset?

At least if you reset the router, the remote management becomes disabled without you having to access the account to do it manually. Easier for basic users to do. Then the account becomes inaccessible from the outside world, right? Isn't the SSH damon also disabled by default? So without remote access to the account, you cannot enable ssh? Correct me if I am wrong please.

When you say "accessible via LAN" , are you referring to your own internal network, ie other users at home / office? Or are you referring to other Unifi users within the Unifi network?

If I understad correctly, TM should disable remote management by default. They just have to reset the router upon installation. If TM requires remote management to do troubleshooting or maintenance, when a user calls the helpline, they can be instructed on how to enable the remote management , do the necessary maintenance and then rest / disable it again.

You may not want to give hints on the details, but at least hint more on the general topic you are referring to...

Guesses..

1. Is TM going to contact these forum admins and request that this and other similar topics about TM be removed or banned? Or the media has been informed not to take up this matter?

2. TM is fully aware of this but they are waiting for something to happen first, then take action or come up with excuses later?
I would think security professionals would rather be pro-active about security rather than re-active.

3 rizvanrp is going to be blown up via remote management?...??

IMO, TM has shown:

1. Failure to make users fully aware of such remote access in the first place.

2. Failure to realise that they cannot guarantee that the remote access would only be used by their support personnel and not a third party, especially with a weak password being used.

3. Failure to take into consideration the security aspects of the users, rather than focusing on easier support

4. Failure to "get away" by trying to use "security by obscurity" method.

5. Failure to be pro-active, rather than re-active. The proposed unique password method could have been done right from the start.

6. Failure to follow some basic rules of creating passwords:
- do not use simple passwords
- do not use dictionary words or simple words as passwords
- do not use the same password on multiple accounts / services