Are you saying, [automatic firmware updates from the manufacturer are table stakes] in the case where someone checks out a router and it seems safe enough at the time, only for vulnerabilities to be discovered later which are not patched as they then should be? Because if that's what you're saying that's a rather excellent point, so thanks for bringing it up.

(Editing to add) So I see what you're saying, that even if Matthew discovers the vulnerability it's table stakes getting it patched but somehow the reverse of that occurred to me, first - that even if it passed muster with him for now, some issue(s) he might have missed could still come up down the road, so nothing's 100% for certain.