Things like OLE can be said in retrospect wasn't a good idea security wise. Autorun kept delivering for more than a decade. Perhaps GDI could do with a security model. That sort of things makes it unnecessarily difficult to secure the system.

The reason we don't hear about Windows router botnets is because nobody bothers building those boxes in the first place. You put your Windows box behind a small Linux box in order to connect it to the Internet, not the other way around.