Oh dear.
Maybe it's the meds I am currently taking or that I am a complete numpty (personally I'd go with the latter), but they have to be inside your network to start with unless they get in via some other infection you've picked up. Then they would need to enable Remote Administration on the router so they can get access from anywhere rather than be in local Wi-Fi range.
Well then just to be sure, I am upscaling my password security to Password1234.