Generally most people don't care for the hard- and software they use. They don't update it and sometimes even try to justify this practice with a wrong interpretation of "if it ain't broke, don't fix it". For such people, its good to have ISPs that patch and monitor the routers. Of course, their motivation varies, and is often near zero, but for most end-users its equals zero. Unlike end-users, ISPs can get bad reputation by the press if they don't patch.
If your technical skills and motivation exceed the average end-users, you can flash your own firmware onto the router. Routers have a general-purpose CPU built in: if you program it to be only managed by you, its only managed by you. With OpenWRT, you can take your security into your own hands.