Bridge mode UI?
 

Just wondering how VM make the UI available on 192.168.100.1 on the Superhub/other modems.

Since there is no route for this subnet within the connected device (that I can see) I'm guessing it's either a NAT based interception or VM's router that acts as your default gateway is doing something clever to route it back towards the modem?

Re: Bridge mode UI?
 

Subnet and NAT are not needed. Your devices send to 192.168.100.1 via the modem as it's the default gateway. It knows the MAC address it needs to send to as it's in the same broadcast domain, no need for any IP routing and the traffic never leaves your home network.

It looks for traffic with a destination of that IP address and internally forwards it to its management interface, again no IP routing.

Simple as that.

EDIT: By the way cable modems are not pure modems, they are also bridges. They have full layer 3 (and actually some layer 4!) functionality and have an external-facing IP address whether or not in bridge mode. When in bridge mode they do just that, bridge, they don't just convert from RF to Ethernet like an unmanaged basic modem would.