Have a look at all the ancient Linux routers everywhere. They have all kinds of nasty security issues up to RCE. Linux and open source doesn't solve anything by itself. It must be brought to the customer -- without interaction.

Security must be the default. Automatic updates, sane default configuration. And a user interface that supports security.