I would assume that liability is avoided when someone has done a reasonable effort to secure the device. The user needs to make sure they've secured their router from unauthorized access by using proper passwords. The ISP needs to make sure the router is delivered with the latest firmware and is pre-configured to be secure.
Because British government has just made leaseholders of apartments liable for costs of fixing forged and fraudulently obtained fire safety certification of apartment blocks.
The manufacturers of cladding materials have forged the fire safety certificate, the construction company has not followed the law when it comes to fire breaks and other fire safety system, the government building control has examined the building and signed it off as correct, possibly corruptly.
But after a skyscraper burned down with all the residents inside, now the residents are liable.
This is ultimately a failing of democracy itself. This stuff was legal, and it's hard to make a law that reaches back decades to impose costs on manufacturers or real estate developers without drastic economic side effects. Leaseholders in theory were one of the beneficiaries of the cheap building techniques, but a lot (maybe most?) of the burden of remediation has actually fallen to the taxpayer - typical politicians, winning votes in the 1980s and paying the tax in the 2020s.
Known unsafe building methods should not have been legal, but we know that politicians have been avoiding legislating this specific issue for more 50 years[1]. Politicians need votes or kickbacks in months or a few years at most. Fire safety is a long term investment against a rare problem. Long term investments against even common problems are basically impossible in modern democracies. For example, if you legislate cycle path networks everywhere people will eventually love them and fight to keep them, in addition to delivering economic and health benefits, but outside the Netherlands very few places do it - because it took 40 years in the Netherlands.
The last few routers I've had from an ISP are totally turnkey. There's no configuration, no passwords set (maybe the local Wifi password), any config is done with an app that talks to the ISP, who then updates the router settings remotely. There isn't even an admin interface you can access from the local network side.