I think automatic updates for a typical all-in-one home router is totally OK, and preferrable, for people who don't have the know-how to improve on it (because I'm not an opsec professional or hobbyist). It's unfortunate that these are also the people who face extended outage when something like this does go wrong. They can't fix it themselves, and the nephew that can might not be available for days.
That's great for people who are into opsec as a hobby. But with the proverbial Aunt Millie I want auto-updates so they're patched.
Asus allows the option of having auto-updates enabled or disabled (forget which is the default).