Well, sure, but it depends, in practice the security risk is smaller.

I've seen many modems with a web interface, but it's often not routable to the public Internet in actual use, as the connection was bridged and the job of getting a public IP has been delegated to the PPPoE connection on the router behind it (You need to add another network interface, assign a IP address on your router inside the LAN segment under the control of the modem to reach it).

Some modems have a management link, it can be described as an universal ISP backdoor, only reachable in the ISP's LAN.

But in both cases, it's still better than a modem/router combined unit.