It's safe to assume that whoever undermined these routers has access to a grab bag of exploits that they are free to attempt at will, and without any detection,

It's safe to assume that whoever undermined these routers has access to a grab bag of exploits that they are free to attempt at will, and without any detection, for all time, because they own your router. I like to think I "run a tight ship" security-wise, but if a state-run botnet owned my router, I don't think it would take long for them to find a weakness and get a foothold into my PC, and it would, in general, be pretty hard for me to know about it happening since I rely on the router to tell me about network activity! (Personally, the best way to accomplish that goal in would be to require the owner to install an app to complete the router installation. The old, unpatched Android phones Wal-Mart shoppers use are generally easy to exploit I imagine. Although I expect that your app could ask for total control over the phone and all data sources, and people will just answer yes because they want their thing to work, and Wal Mart wouldn't sell it if it wasn't safe.)