Internal devices are typically isolation from the world though, unless you have NAT punch a hole through it. It doesn't matter (as much) if the router has security holes if a hacker can't get to it from outside the network. I don't recall hearing of any hacks that have pushed through the ISP's modems, down to the router, and into local devices without ports punched through NAT to the outside world.