Apple AirPort Firmware Data Deletion Vulnerability

IMHO this is really the only concerning part because it sounds like something that can be remotely exploited; knowing the wireless network name and key is only worth anything if you know where that network is, and can actually go there and do something.

a "factory-default" reset just moves the configuration file to a new location on the device, and the old file and up to two additional previous configurations remain accessible on the device.

When doing a factory reset, repeat the process at least three additional times to cycle the data out of ACPData.bin.3.

That sounds like a "last known good configuration(s)" feature to handle the inevitable "I thought I'd reset it because it wasn't working, and now nothing works anymore!" but perhaps the feature was never fully implemented due to other factors.

Before updating, I questioned whether I should even bother applying the update, but figured better safe than sorry in case it contained some important security patches. Glad I did!

That sounds like an interesting behavior to debug.

A company with as much resources as Apple should not be given this much time before publication. A Project Zero-like 90 days grace period should be fine, especially as you need either physical or SSH access to such a device.

I know Apple tries to make people who report bugs stick to their procedures and agenda but taking over 300 days to roll out a patch for a product that was not seeing any active development regardless? That's quite a lot of patience to keep.