> Have been wondering if these consumer protection things also extend to software side. For example is a mobile phone or Internet router considered broken, if the software contains critical security problem for which no patch exists?

Would you consider your front door broken if it is vulnerable to being opened with a screwdriver? What about a wine glass that breaks unless you aren't extremely careful when washing it?

In my opinion it depends on how it was marketed.