[Zikes]

I'm curious about this as well.

It's hard to imagine it's just software, as the router firmware could be validated against the manufacturer's own available on web sites. It could similarly be circumvented via a manufacturer software update (or open source alternative).

On the other hand, swapping out hardware en masse could get expensive, but the NSA has probably spent more for less.