Why do routers stop getting security updates, and does it matter?
Because manufacturers set an end-of-support date after which no fixes are issued, and it matters more than for almost any other device — a router sees every packet on your network and is permanently exposed to the internet.
Why support ends. Routers are sold on thin margins with no recurring revenue, so engineering time spent on a discontinued model earns nothing. Many run heavily modified older Linux kernels and vendor components that themselves stopped being maintained, so backporting a fix means updating a software stack nobody has touched in years. Some models are rebranded reference designs whose original manufacturer has moved on entirely.
Why an unpatched router is worse than an unpatched laptop:
It is always on and always reachable, with its management interface, UPnP or remote administration potentially exposed.
It sees everything, including DNS queries — and a compromised router can silently redirect them, which defeats a great deal of other security.
Nobody looks at it. A laptop shows symptoms; a router quietly joins a botnet and keeps working normally.
It is a foothold onto every device behind it, including those with no security of their own.
What compromised routers are actually used for: distributed denial-of-service botnets, proxying other people's traffic through your line, DNS hijacking to insert advertising or phishing pages, and cryptomining.
What to do:
Check the vendor's security advisory page for your exact model and whether it is still supported — the answer is frequently no for anything over five years old.
Turn on automatic updates where the router supports it.
Disable remote administration, UPnP and WPS, change the default administrative password, and check no port forwards exist that you did not create.
Use the ISP's router if it is actively managed — a provider that pushes firmware automatically is a genuine advantage over an unmaintained retail unit.
Replace it when support ends. This is the real answer, and the one people resist because the device still appears to work.
Open firmware is an option on some models and extends support considerably.