My ISP provides a combo box (ONT + router + switch + Wi-Fi) which they can manage remotely, likely using TR-069. They automatically push default configurations to the device. After I do a factory reset, and change the root account password, they can even override the password with theirs once the fiber optic cable is plugged in. User's changes after that remain, though.
Do they get complete control over the device? If it is the case, it is most likely a security risk if I use that box in a production environment.