Not updating the router just sounds like another security incident waiting to happen. The botnet will just be on your router instead of your fridge

Updates themselves are a security risk, because they're a first-party malware vector. Pick your poison.