The most egregious, for me, is that while they published the source code for their firmware as GPL (good) they were too lazy to incorporate fixes made by a thir

The most egregious, for me, is that while they published the source code for their firmware as GPL (good) they were too lazy to incorporate fixes made by a third-party developer who was fed up with their buggy software and decided to do something about it. The AsusWRT Merlin builds are much higher quality and the source code to them is, per the GPL, also available. It's one thing to not fix security issues, it's another thing to have a single guy fixing your security problems and not even be bothered to take his work and pass it on to your customers. They deserve all the punishment they're receiving.