most of the routers are patched by ISPs directly.
also: they are usually not x86 architecture - so not all exploits are possible.
MIPS and Arm have no security issues ever so never need patching which is an x86 only thing? Or maybe this comment is no more relevant than pointing out not all Arm patches apply to x86?
LLMs are giving script kids nation state level tools and expertise.
Defintely seems potentially better than no updates at all.
How do you know if you have a wide open CVE they're ignoring, like it's claimed ubuntu are doing?
Perhaps better characterized as "buy your own device". Cable ISPs will only support a limited set of modems on their network, and they're fully managed by the ISP, both in terms of software and configuration.
I've had probably at least about 5 routers supplied by 5 different ISPs over the past couple of decades and not one of them has ever got a security update. Is that an usual experience?