[simon_vetter]

You can disable their http/https/telnet interfaces and stick to ssh with key auth for administrative tasks. That alone should help.

Also, they come with upnp and other unnecessary daemons disabled which greatly reduces their attack surface.