The main reason I can see for changing the default login and password is because the initial contact between the router and a device is unencrypted. If there's a remote admin hack that allows an intruder access to the router login, the passphrase makes no difference.

And you don't control all access; it is a wireless router, no?