If this is actually the case then you should contact the FTC because Asus under an order to pay attention to security:
* https://www.ftc.gov/news-events/news/press-releases/2016/07/...
I have an Asus RT-AC68U that I bought ages ago that's still getting regular first-party firmware updates (plus the ones from Merlin). Currently using ISP-provided hardware, but given my past experience I'd definitely look at Asus as an option if I needed a new router.