In order to be vulnerable, a system needs to run malicious code. This is an especially big deal in the context of virtual machines in shared hosting, because yo

In order to be vulnerable, a system needs to run malicious code. This is an especially big deal in the context of virtual machines in shared hosting, because you have no idea what code is running in other virtual machines on the same host. It also impacts end-user systems because the web is basically 100% untrusted code. Even if the cpu in your router is vulnerable, what untrusted code is it expected to run? None of this is to say it's not something that should be fixed. But it's low priority, as it requires the ability to execute code remotely already.