According to the blog post, that CVE (CVE-2017-14491) only allows a 2-byte overflow on Dnsmasq >=2.76, so hopefully that's enough to prevent it from being exploited effectively.

2.76 was only released 16 months ago though. There are probably tons of router firmwares out there that are way older than that.