CM1000 and VOIP plus a security question

Hi,  I have a cm1000 with Xfinity service and a mesh wireless router system from another company- things have been working fine as best I can tell over the past year.  Today, I wanted to add VOIP from Xfinfity and noticed my modem is not set up for it.   Is there an add on device I need or do I need to completely upgrade modems to add that functionality?

Related Security Question- Embarassingly, while researching the above issue I realized my modem has a user name/pw and that they had been left in the factory default since the install date- well over a year ago.  I immediately changed it but  go to wondering what could have happened.   Now, I realize the potenital implications of someone making on to your actual network or wifi, but hypotehtically, what damage or mayhem can somone do  or cause if they had access to my modem and its default credenials?   Wouldnt that attack have to come from within my local network though?  If not, they coudlnt access the modem anyway, even if with the default passwords.   Please enlighten me.

Thanks very much.

Sys