Too many attack surfaces, not enough hours

from here and here

The idea that you can be secure if you just keep everything up to date ignores how many things need to be kept up to date and how much more difficult it is for some things than others. So when people go around installing malware on routers there's a pretty good chance there won't be anything standing in their way most of the time.