My ISP provides an online user interface where I can remotely change my Wi-Fi password even if I haven't explicitly enabled port forwarding. If they have access to that, I don't see why they can't easily see my network shares and its contents (I don't password protect the directories for convenience reasons).

I've long ago lost the PPPoE password and this same router gets it automatically somehow. When I install another router, it won't do that.