I'm a longtime daily Unix and Linux user (20+ years), though I dare not call myself an expert since it takes several lifetimes to achieve that in a system so deep 
I've also developed Linux kernel drivers though it's been a few years. I did debug a nasty CPU cache corruption issue on Openwrt with a defective R7800 SoC (link) - that router was tossed out.
All of my configuration changes are rather tame and nearly all were done through LuCI so nothing much more than the average seasoned Openwrt user. Nothing exotic for sure.
Not sure why my SSH setup caught your eye. It's pretty standard setup with a public/private key pair in place of using/allowing user/root logins for SSH.
I've removed bash on the routers, as I agree with @psherman that is the most likely culprit. Haven't seen the password change since doing that yesterday. Will report back either way.