Re: Free Markets
You don't get automatic security updates because with a router they are likely to require you to reboot or at the very least to drop existing connections. So you are likely to want to schedule the update yourself. Or you can install your own automation. The market at present is Linux-capable enthusiasts and maybe a few businesses.
If they ever start selling a router with an OpenWRT derivative (or similar) to the general computer-using public, they might decide it's better to ship the thing with an auto-updater that installs security-critical updates immediately, and others overnight around 4am. The few for whom these defaults were wrong would be able to change them -- or indeed, to load some other open router distribution altogether.