Also, while Mikrotik security practices are not great (as I recall, before this vulnerability, admin passwords were stored in plain text), by default, I think z

Also, while Mikrotik security practices are not great (as I recall, before this vulnerability, admin passwords were stored in plain text), by default, I think zero services listen on the WAN port. Owners must specifically configure their device in a not recommended manner (exposing the low-quality web admin interface to the world) for this vulnerability. It's like exposing your printer web interface to the world and expecting it not to get hacked. The main problem with Mikrotik is that the configuration interface is too low-level and it's easy to fall into such traps.