Even if it turns out (once this event has been fully understood) that the vendor-installed firmware "phoned home" to collect an update of sorts that led to this?
You're looking at your phone on a day to day basis. Using your desktop. The router/switch/lightbulb/etc? All stuff that sits in the background and gets forgotten. Those things should do self maintenance - especially with zero days and issues that require updates to not be pwned the instant you connect to the www.
But realistically, it's definitely better for the "masses" to have stuff that just takes care of itself. Grandma don't know how to update router firmware and people like that are why stuff like Apple's "appliance" model is better than Androids more hands on approach.
I do prefer Android for streaming devices, there’s just too much value added from using Android there. But I use an iPhone because I just want my phone to work. And I limit my desktop computer count to exactly one. For networking, I use Asus Merlin. I don’t use it for its flexibility or features, just for the stability which this recent news confirmed was a good idea. The only special features I even use are an OpenVPN server, and secure DNS over TLS to cover my devices that don’t support DNS over HTTPS.
(add.: and I don't mean "different kinds of people" in a condescending way, but that we value different aspects and have different methods for going about these things)
Depends a lot on the use case, though.
Yes, because I can plan for it. I can do it on a weekend or a local holiday. I can do it in the evening after work, or in the morning so that I have the whole day to go out and buy a replacement. If it's not critical, it can wait until my vacation.
And even without any risk of bricking, it should still be done on my schedule. I don't want the connection to glitch while I'm in the middle of a live stream, or an online multiplayer game, or a call with a distant relative.
Normal case: You lose some features / quality of life / stability improvements for a day / week / month (whenever you get around to updating it).
Best case is that you aren't in general population of bricked routers like everyone else today.
Worst case scenario is that you're late to a zero-day exploit. Although, the tech news cycle tends to report those stories pretty well, so you'd be aware of it.
The pros definitely outweight the cons in my opinion, especially on something critical like my internet access.
So against the one time you win by manually updating, you are weighing hundreds of times you had to research before clicking ‘update’ to see if there were any reports of this update bricking routers?
Because if you don’t do that, you just click the update button whenever you get round to it, you are running your router in a ‘vulnerable to zero days’ configuration, AND you’re going to brick your router the one time they ship an update that goes bad.
That's great for people who are into opsec as a hobby. But with the proverbial Aunt Millie I want auto-updates so they're patched.
Asus allows the option of having auto-updates enabled or disabled (forget which is the default).
Hardware and software companies have a story of implementing anti-user features in very shady ways (ie silent update to T&C allowing the org to track and share data with third parties and/or brokers).
I don't care if my smart Philips light bulb shares all its data with god knows who. My router? that's the device that manages all connections including critical ones. I want it to be impeccable and transparent. That's why I refuse to buy from manufactures that require a could account like Eeroo or that require weird connections to work properly like Tenda (a friend had a Tenda mesh and it wouldn't work if we blocked connections to Baidu, Weibo and others)
I have auto-updates disabled.