The cause of all these exposures is Brother's choice of shipping the printers with no admin password. Most organizations most likely connected the printers to their networks without realizing the admin panel was present and wide open to connections. These printers are now easy discoverable via IoT search engines like Shodan or Censys.
...
For example, an attacker could change the printers' passwords and cause downtime to affected organizations.
...
An attacker could include spyware-like behavior in tainted firmware updates and have printers send copies of printed documents to an attacker's server.
I'm safe as long as it's only on my network right?
Yeah I got upnp disabled in pfsense. I had not heard of that till maybe a few years ago, that's a scary feature...