Short of building/installing your own router how can a highly sensitive business protect themselves from things like this? Obviously you don't want to be running random vulnerable hardware that is never updated. But what else?

I was thinking about having multiple layers (security loves onions!) with interchangeably components that you roll over at random. That way any given attack vector at one point might be mitigated by a different interface below it. Literally unplugging and plugging things in to shake things up.