The telnet password used by the botnets and the admin control for the end user are separate in many of these devices. My understanding is that the telnet password was set to not give the end user the access to change it, well, with the exception of technically savvy end users.

Let me rephrase that, many of these devices have a wise open port 23 and other ports through which Mirai accessed a backdoor.