Guessing by how frail software on these types of devices (routers, access points, home automation stuff, DSL modems, cable boxes, consumer NAS enclosures, etc etc) often feels, I fear it's the latter.
Further, all too often, minimum mitigations -- sometimes, the word "solution" cannot even be accurately applied to these -- are conceived and implemented.
When you see repeated problems cropping up like this, based upon experience, I can express the opinion that the organization and/or the individuals involved are not really paying attention or respecting sufficiently the security aspects involved.
Hopefully, the repeated bad press will begin to change this. But... those in the organization responsible for setting or sanctioning such initiative, are often all-to-well insulated from the immediate "real world".
--
[1] P.S. I guess I should qualify this to say that I'm speaking of what I consider to be a typical "corporate" environment. Lots of politics and inertia and, all too often, "just do what you're told".
I do think embedded devices as a whole are getting a lot more attention lately - because they're so fun to hack.
A consumer home router is often quite similar in terms of hardware to a Linux box from say 1995 (with differences due to Moore's law versus Kryder's law). 20 years as a rule of thumb is OK. Unfortunately the development practices you see tend to be 20 years out of date as well [shoddy, non-memory safe code, with no automated tests, talking to the network].
This is partly why hacking embedded devices is fun; it's like the 90's again! [I think every pentester has dreamed about the idea of being transported to 1995, knowing what they know now...]