(Anecdotally I've had three Netgear devices in my life and all of them caused severe problems. Enough for me to have them on my personal blacklist for life.)
There's code in there besides the kernel that could have (security) bugs and backdoors.
Unless ASUS botches something badly, my next router will also be ASUS.
The hardware design and manufacture is outsourced to different vendors, in this case to Foxconn. See here: http://en.techinfodepot.shoutwiki.com/wiki/Netgear_R7000
The software engineering is probably also outsourced mostly.
The board manufactures normally do not want to upgrade. I very rarely see that device manufactures are doing a major kernel upgrade when a new SDK with support for a new major kernel is available from the SoC vendor. This only happens when they need new features from the new major kernel which can not easily be backported and a very big customer is requesting this and normally they also need a good internal software engineering department.
That just means the device vendor isn't exerting the necessary pressure/valuation on the SoC manufacturer.
Of course the SoC manufacturer is gonna try and get away with bare minimum of work for absolute maximum of profit, just like the device vendor. The pressure needs to start at the end of the chain (which is end users) :/
(could even be a "best before" date on electronics; at least this way you know what you get when you buy, the vendor can decide on their own how much support they want to offer, and the user can choose between the "good for 2 years" router and the "good for 5 years" one...)