Most routers are shit. Manufacturers slap together a version of linux, some crappy web ui, and ship it. It is unlikely to receive any updates or patches.

Manufacturers should be liable for the poor quality of the devices they make. Software vulnerabilities are a fact of life, because there is no driving force to be better. Strict liability would force the industry to be more like other engineering disciplines.