WEP aside, leaving web admin access on is just totally pointless for 99% of users, not to mention a much worse thing to leave enabled in comparison. Might as well plug your computer straight in to a modem with no firewall at all...
Maybe someone wants to the change port forwarding remotely so they can VNC into a particular machine on their LAN. Admin screen is obviously passworded.
