This is (kind of) a non-issue.

The hard coded su password only exists in the TPG (an Australian ISP) version of the VR1600v software. The main admin user is unable to set VOIP server details and authentication etc.

If you get a vanilla TP-Link VR1600v, you'll find there is no such hardcoded password, and the normal admin account has full access to VOIP and CWMP settings.