I'm waiting for this bullshit to appear on ordinary routers...
But there's nothing to stop an attacker from rewriting the "write protected" areas like e.g. a firmware update does.
Consider that many routers these days come with NAS or MediaServer functionality... and thus are a valid target for hackers.
Furthermore, they are often directly connected to the Internet, and there have been numerous remote-root exploits for cheap chinese knock-offs as well as for highly praised manufacturers like AVM.
If you're logging in or sending financial data over unsecure (non-SSL) connections, you already have a problem.
Take for example an old lady down the road who somehow got some futuristic malware on her router. She goes to Bing to search for Wells Fargo to do some online banking (and you know that there is a huge portion of users who only browse the web this way). Hypothetical malware then just runs SSLStrip over the page from bing.com which isn't served over ssl because Microsoft values their bottom line over your privacy and security, which then replaces the link to the https site with http, the router acts as a proxy between http and https so wellsfargo.com is none the wiser. Evil hacker now has poor old lady's password and transfers the money in her account to his own foreign bank account.
This hypothetical scenario is doable even running off of a slow router while not using many more resources than the parental keyword filtering uses. At no point does SSL ever come into play and the top 4 Banks in America (Chase, Citibank, Bank of America, Wells Fargo) don't use HSTS so there's no real way to protect their users from SSLStrip unless a browser includes them in some force SSL list.
Speaking as a security officer for a (non-US) bank, this is not true.
We use EV certificates (to increase visibility vs. standard certs), deployed HSTS over a year ago on most of our propierties, force HTTPS and pin keys wherever we can (i.e. mobile apps). And even if a session is compromised: transactions are screened and verified before execution.
Yes, our chief concern remains the bottom line. Pushing for more trust increases our user base. Fighting fraud avoids compensation payments. Building awareness and implementing technical measures aids both of these goals, so we get to spend a reasonable amount on both.