Google sat on a Chromecast bug for years, now hackers could wreak havoc

Does the "PewDiePie hack", done via UPnP, have anything whatsoever to do with the Chromecast deauth bug, which, as far as I can tell, requires being on the same WiFi as the Chromecast? This article, and some others I have read seem to conflate the two. None go into details of what the UPnP bug actually is.

Routers seem to be allowing access to the Chromecast from outside the network, which seems like a router bug, not a Chromecast bug. Is there something that Chromecast is doing with UPnP to turn this on?