You're likely talking about designs that typically didn't include encryption and significant software reconfigurability. Many modern routers run on some sort of Linux base. Linux isn't entirely bulletproof and with its flexibility comes some element of risk. Modern routers are computers, not some sort of glorified Strowger switch.
Routers often include public domain code by reference and when something is found that is wrong with that code (i.e. Heartbleed), a conscientious manufacturer will update the firmware. Other times there is mean-spirited software that attacks a particular brand of router (i.e. TheMoon with Linksys routers). When these are discovered, there should be at least one firmware update to update the product so it isn't open to attack. Occasionally it is necessary to disable certain technologies as just too messed up to fix (i.e. WEP, SSLv3).
How many iOS releases appear to have "broken" routers only to discover that a subsequent release restores interoperability? iOS 8 was particularly messed up in this respect with a nasty DHCP bug. This is not your father's Oldsmobile.