Devices like routers should have firmware in memory that has read-only access. The access should be turned on or off by a physical switch.

This way, if malware gets installed on your router, doing a cold boot will eliminate it. You can have a timer to just cold boot it regularly.

I've suggested this many times. The rationale for not doing it is so the firmware can be remotely updated. Well, that's exactly how malware infects it.