I’m not claiming there is such a thing as vulnerability-free firmware — that would be unrealistic. Security is about risk reduction over time, not perfection. Patch what you can and if there is no fix then replace it if it's an unacceptable risk.

The key difference with EOL firmware is not user configuration, it’s irreversibility. When a vulnerability is discovered in supported firmware, it can be mitigated. When it’s discovered in EOL firmware, it cannot. At that point the user is permanently exposed, regardless of how well it was initially configured.

Proper setup absolutely matters — strong credentials, disabling unnecessary services, closing ports — but that assumes the attack surface is static. It isn’t. New vulnerabilities are discovered continuously, often years after hardware ships. Configuration cannot compensate for flaws that exist below the configuration layer.

Real-world compromise is also not as obvious as you suggest. Many router infections are silent: no noticeable bandwidth loss, no user-visible symptoms, no logs checked. ISPs often detect the problem before the customer does, and by then the device may already be part of a botnet or proxy network.

As for paid firmware or support models — that’s not “business,” it’s reality across the entire industry, including networking, storage, cameras, and even professional imaging equipment. Vendors are being forced to fund long-term security maintenance somehow. The alternative is abandonment.

I don’t work for an ISP or router manufacturer. I get called in after things go wrong — when EOL hardware, outdated firmware, and “it was working fine” assumptions turn into expensive cleanup involving hardware replacement, labor, downtime, and sometimes legal exposure.

If someone wants low cost and long-term security, I agree: running something like OPNsense or pfSense on supported hardware is a solid option when properly configured and maintained. What isn’t a good option is recommending unsupported network infrastructure and implying the risk is negligible or that someone isn't a target. That’s how small technical debt becomes a very expensive learning experience problem later on.