Short answer: It erases the volatile memory, which is where the plug-ins are stored that you're referring to. This was what was doing the heavy-lifting of the malware.
To fully get rid of malware, you are correct that the router's firmware will need to be upgraded or wiped and re-installed, but the malware referenced here used various plug-ins that lived in and used the volatile parts of memory, similar to the RAM. This means a simple reboot killed whatever plugin was in use, but did not totally disinfect the router.
Check here for a more in-depth explanation. Some important excerpts from the link include:
Once in place, the malware reports back to a command-and-control infrastructure that can install purpose-built plug-ins, according to the researchers. One plug-in lets the hackers eavesdrop on the victim’s Internet traffic to steal website credentials; another targets a protocol used in industrial control networks, such as those in the electric grid. A third lets the attacker cripple any or all of the infected devices at will.
That allowed the bureau to identify a key weakness in the malware. If a victim reboots an infected router, the malicious plugins all disappear, and only the core malware code survives.