Asus has some pretty jank DDNS and remote access defaults, and they like to push their suite of mobile apps for managing that crap. If SoHo users aren’t limiting device connections to trusted endpoints then maybe that’s how these routers are being compromised? It’s not manufacturer specific but Asus is the majority according to the article.