[montzark]

Maybe easy fix would be some certification requirement for routers that by default ports to device are closed even from same network? Some time ago there was issue with default passwords and it got solved with default passwords unique to device.

[_trampeltier]

Such devices can also be attacked in a second stage from a compromised PC or so. Such devices have nothing lost in a production LAN at all.