I suppose the issue is really the risk; attacks on infrastructure need to route over networks; even a completely vulnerability ridden machine isn't a risk if it

I suppose the issue is really the risk; attacks on infrastructure need to route over networks; even a completely vulnerability ridden machine isn't a risk if it isn't reachable from the net (inbound or outbound). Routers as the gateways into all sorts of networks, and they see/control all of the traffic in and out and often between devices on the network; they're a critical junction.