The router sitting in the corner of a home or a small office is easy to think of as a passive appliance, like a plug socket - installed once, blinking away, doing its job invisibly. In reality it is a small computer running its own software, and like any computer that software has flaws that get discovered over time and fixed by the manufacturer in updates. The difference is that almost nobody updates a router. It gets set up on the day the internet is connected, pushed out of sight, and then left untouched for years, quietly running whatever version of its software it happened to ship with.
This matters because the router is not just any device on the network - it is the front door to all of them. Every phone, laptop, printer and connected gadget in the building reaches the internet through it, which makes it an unusually valuable target. A flaw in an unpatched router can let an attacker redirect traffic, snoop on what passes through, or use the device as a foothold to reach everything behind it. Because the router is always on and rarely examined, a compromise can persist for a long time without anyone noticing anything wrong; the internet still works, so nothing prompts a second look.
The gap is widened by how the update process is designed, or rather not designed, for ordinary users. Phones and computers nag you to install updates; routers generally do not. The update usually sits behind an administrative page that most people never open, sometimes behind a default password that was also never changed. So even a manufacturer diligently issuing fixes is issuing them into a void, because the mechanism assumes someone will log in and apply them, and for the typical home or small office nobody ever does. The result is a large population of internet-facing devices running years-old software with known, published weaknesses.
The remedy is undramatic and mostly a matter of remembering the device exists. Check whether the router can update itself automatically and turn that on if it can, since the best maintenance is the kind that happens without you. If not, it is worth logging into it once or twice a year to apply whatever updates are available and, while there, to change the default administrative password if that was never done. It is also worth knowing that routers, like all hardware, eventually stop receiving updates altogether; one that the manufacturer no longer supports is quietly accumulating unpatched flaws and is worth replacing. None of this is glamorous, but the router is the single device through which everything else passes, and keeping it current is one of the highest-value, lowest-effort security habits a household or small business has available.