And most importantly: keep it updated.

About the only thing I would trust without updates is a bsd box. And even that, may eventually fall victim.

What if you are too busy for that?

That's actually a really good idea! I would love to see this built-in to future router models after something widespread like this. It's fairly reasonable to force users to be physically present to update. Plus, you could force them to flip the switch back by not working until the write-enable line is disconnected again.

Ain't nobody got time for that.