This is a bit of a spurious comparison. Nobody is dying from an unpatched router. Why should a company be on the hook for a device, particularly if it's out of warranty? If you expect more than that, you need to be buying something with a contract stating you're going to get more than that.
I find it regrettable that the architecture commonly in use does not make a clear distinction between devices for convenience and for security.
It’d be crazy if in our homes the main entrance lock always came as an afterthought in the package of all the inside doors, and we didn’t have an obvious way to replace it separately on our own.
This case is more like a golf cart being sold as a car: it's technically usable for that, but lacking any sort of safety or weather protection.
Not just financial damage, the owners of defective routers can be targets of criminal lawsuits if their connections are used as proxies for attacks, death threats, bank fraud, etc.
That does have the potential to create some damage if anyone takes control of them. Maybe even kill some people, if say they DDoS the V2I network for self-driving cars in the future, or a hospital network over which remote surgeries are performed, etc.
I feel like this argument that "you get what you pay for" is pretty lazy. Usually, or ideally, consumer regulations are about setting standards and raising the bar.
So that means that if there were strong laws for stuff like this, then the minimum router price may become $70 instead of $50 - but everyone would be reasonably protected for the large majority a device's lifecycle (only a small portion of the customers should be affected by leftover bugs when support ends, like say <5%, as others will have moved on to new products by then).