Are Windows 0-days really that common? I thought they were usually saved for really serious attacks, e.g. from state-sponsored actors, not scams on the level of "pay some random person $15 a month to attach a mysterious device to their router".
Not only that, but because the device has unfettered access to the internet, an attacker can always update it with new ways of installing certificates on your machine.