… but when that will happen, around year 2047, the unit will probably have been replaced, by a new one running RoS 42.2 that will use telepathy instead of user/password credentials …
Strangely enough, brute-forcing times depend on the rate on which you can try a value (and wait for the response of the device), so, even if you expose access to the router from WAN 
, and the rate to which the attacker can probe (without choking the connection or the device itself) is very limited, in the order of magnitude of tens per second, possibly hundreds per second. I have seen logs with 8 attemps per second, example: http://forum.mikrotik.com/t/many-attempt-to-log-in-from-winbox/139277/1
But let’s exaggerate and assume 100,000 per second.
The super secret admin name I use on all my devices “pippopippo” [1], probed at 100,000 attempts per second takes max 44 years time, on average 22 according to this calculator:
https://www.proxynova.com/tools/brute-force-calculator
(“pippopippo2” will take 1163 years)
[1] no, wait, … 