A useful distinction here is model exposure versus evidence about a particular unit. I’d check the exact support and firmware path first, then WAN management, admin accounts, DNS, forwards, clients, and logs. Missing evidence stays unknown. If a trusted firmware or recovery path cannot be established, replacement is stronger than treating a factory reset as proof.