Internet routers running Tomato are under attack by notorious crime gang

Including "running Tomato" is a great step. Too often, these warnings, which a great deal of the time are only relevant to machines running Windows, do not include "running X" in the title, so everyone, even those not running X, have to read the article to ensure they're not vulnerable. I believe journalistic integrity demands that the OS/App/whatever appear in the title.

... only vulnerable if the default has been changed to ALLOW remote administration, and are using the default admin:admin or root:admin credentials.

Why/how would you be smart enough to run custom firmware on your router, but not set your password, even while enabling remote administration?

(Are routers pre-loaded with Tomato being sold to naive people somewhere?)