That’s a totally reasonable point of view, would be nice. But, the days of fixed-function hardware are almost completely gone. These routers (and lots of electronics) are just Linux computers stuffed in small boxes, and come with a lot of the same kinds of dependencies as your desktop. As such, when a security vulnerability is discovered, for example, it’s kind-of a good idea to be able to accept a software update, and when people are discovering them in every corner of the OS and utilities and daemons they run, it suddenly makes sense from a completely practical perspective to update automatically on a regular basis, which is what most people need for their computers & phones. They all should accept and respect the ability to disable auto-updates though. Maybe this case is an exploit or something.