Re: Others problems first
I'd start with consumer routers, personally. Once your edge gateway is secure it can police everything else. Forget shiny boxes and wireless range, make the damned things fit for purpose first. Step one: make forwarding packets either way to ports 137-139 and 445 blackhole routes by default. Not reject or ICMP unreachable, blackhole. While it's wondering where its packet has gone, it's leaving someone else alone.
And can we please stop enabling uPNP out of the box? It makes setting up C&C links trivial for any slightly clueful villain.