What are the risks that people like me face and what is the likelihood of something untoward happening to an ordinary domestic user from using a bog-standard vintage ISP-supplied modem/router?
Pretty low actually.
1 - As Andrew also says, change the WiFi password and network name.
2 - Change the admin password to the router (so its not the ISP name etc).
The benefits of using the ISP supplied router include:
1 - ISP updates it centrally, often overnight (BT, Sky, and others do this)
2 - If there is an issue found, the ISP is in a position to manage the risk, they can�t do this with third party equipment
The downside is the ISP supplied routers are often very simplistic, and in some cases even have very poor WiFi range compared to alternatives.
plusnet 80/20 (2/jun/14) at 470m - Sync history highest: 64/9 (Sep/17), 54/6 (Jan/19), 51/6 (Mar/19)
20 years of broadband from 1999's ntl:cable modem trial - Live BQM