Asus has some pretty jank DDNS and remote access defaults, and they like to push their suite of mobile apps for managing that crap. If SoHo users aren’t limiting device connections to trusted endpoints then maybe that’s how these routers are being compromised? It’s not manufacturer specific but Asus is the majority according to the article.

ASUS will charge you an arm an a leg for a ‘premium’ consumer router but will not handle VLAN traffic appropriately. And if you are betting on Open-WRT to save your bacon it’s not a great bet.