Let's not get into the discussion of whether or not everything that can be connected to the Internet should be. (I'm in the "should not be connected camp", but I think my question can stand on its own without this discussion).
The second answer is also obvious: Try to avoid as many bugs as possible before shipping the product. If you include a highly exposed software like dnsmasq make sure you look for bugs in it before shipping it.
I don't remember having seen any professional security audit for dnsmasq before. Such an audit is probably an almost irrelevant expense for all the router manufacturers out there, yet none of them chose to fund one...
Open source is extremely heavily used by commercial software and hardware manufacturers and the reality is that very few of them contribute back, meaningfully, to Open source security.
The end result will continue to be bugs like this, with ever growing impact.
"Tragedy of the Commons."
If all manufacturers in the space assume someone else will pay for the audit (or assume it won't get audited), then it doesn't get audited. If one does pay for it, they all get to benefit due to the nature of open source patches.
It's funny yet sad that it took Google Security acting on a bug report by a (presumably unrelated) engineer to find some of these security issues. Google has strong incentives to protect its own network (its livelihood depends on intellectual property and safeguarding data). The companies that sell mostly disposable SOHO routers have such little interest in security, yet it's literally the gateway most of us use to the internet.
Mozilla ("Secure Open Source" [0]) funded an audit of dnsmasq [1] by Cure53 [2] about a year and a half ago. The final report [3] (PDF) lists one "medium" and five "low" issues.
It just goes to show that a "successful" audit (i.e., one that doesn't find any major/critical issues) ultimately doesn't prove much of anything at all WRT the overall security of a piece of software.
[0]: https://wiki.mozilla.org/MOSS/Secure_Open_Source
[1]: https://wiki.mozilla.org/MOSS/Secure_Open_Source/Completed#d...
[2]: https://cure53.de/
[3]: https://wiki.mozilla.org/images/f/f7/Dnsmasq-report.pdf
At least with Android, Google is forcing manufacturers to have a minimum security patch lifetime. There's no one in a position to require or enforce that among the tens (hundreds?) of thousands of home/SOHO routers models out there.
I expect we'd maybe be able to get some of the big players (Netgear, Linksys, D-Link, etc.) to agree individually to support products with security updates for X amount of time, but it's still dicey. I used to work for one of them[0], and often the people internally who own the products don't even know enough about the software running on them to even be aware of security issues. They're entirely at the mercy of the outsourced software firm for that. The margins are low enough (and price competition high enough) that you're not going to see much effort without consumer support. That is, consumers being actively willing in large numbers to pay more for a more secure product (so, that's not happening).
If we could go by a model where everything was based on a third party, like OpenWRT or LEDE, and if the appliances could auto-update in-place from the upstream package repositories (nothing run by manufacturers or the software integrators), then that might work, but the manufacturers would have a hard time supporting it, as I'd expect there to be a lot of random breakage.
I'm not sure there's a great solution here. Savvy consumers will pick a brand that has a strong track record with security (perhaps buying SMB or enterprise-grade products), or will flash 3rd-party firmware that they can maintain and upgrade themselves. The masses are pretty much lost and dependent on a commodity industry that has little incentive to pay close attention to security, and a lot of incentive (in the form of cost and pricing pressure) to ignore all but the worst security problems.
[0] This was 2004-2009, so things may have changed, but I'm not expecting much.
Yep, I'm enjoying my OnHub.
ISPs bundle routers with their contracts. So if their customers get attacked through hardware that they supplied they will have at least some incentive to put pressure on the upstream manufacturers.
The downside is that they yet again break P2P protocols, although that's somewhat easier to fix.
You can get the same protection NAT offers for IPv6 with an incredibly basic set of firewall rules, only allowing devices on the LAN side of the connection to establish connections and punching holes where necessary.