This is a stupid report because even if they're not stored in plaintext, there still has to be a decryption key stored in non-volatile memory somewhere to actually use these credentials, otherwise you would require the user to authenticate to unlock the credentials every time they were going to be used.

You could have the credentials encrypted at rest and then the user would have to provide a master key every time they boot the router. Who do you know that would do that? Reset the router and have to dig out their security key or provide a password before it can boot up? Not a chance. A boot up credential would be stored on a device permanently plugged into a USB port and it would be vulnerable to the exact same physical access attack.

This seems like the kind of "vulnerability" that would be reported by someone just looking for something to report so they can put it in their portfolio, not someone that actually understands security design for consumer devices.