&gt; it's most likely just incompetence (leaving a telnet server wide open), not an intentional backdoor, although you can rarely say with absolute certainty that it's not one looking like the other. 

This 100%. I've hacked at *dozens* of consumer devices (mostly ones that run Linux on small processors) and better than half have some default credentials the developer "forgot" to remove. It leaves them vulnerable for the developer, or his company to enter the device once it's installed and do whatever they like. Is that happening? I doubt it. No one has ever seen it happen that I'm aware  of, but it's a possibility.