I don‘t think they need to discover it, they would have a standard entry. There is always an alternative entry they can give me when on an occasion I locked myself out of my router, and it wasn’t the password from under the router.
I’m not sure how they do it and I doubt they would tell me. Also, I should mention that this was a BYO router, not ISP supplied.
So I can only assume they get in via the fact I am synced with their server or something.
On the occasions that they have supplied a new modem that may have died when using one of theirs, they pre set it up using the same config that the original one had. Perhaps in my user profile there is a config file at my ISP.