No, you're thinking of IOS-XR. IOS-XE runs on just about everything now, from routers and switches, down to the access points. The switches (minus the 9200s) and routers can run LXC containers. And that's just the Cisco world.
Even some platforms running DD-WRT can run docker containers now. With MCUs in everything now (ok, maybe not toothbrushes -- yet), anything that touches the network is a potential "computer". I have a $5 ESP32 MCU sitting here on my desk running my own micropython code that can connect via bluetooth or wifi. It's a little bigger than my thumbnail and can run off a LiPo battery at 3.3v. Security-minded folks MUST keep these vectors in mind.
Your post causes me to believe even more strongly how important it is to gain copies of all the router logs and config files.
If copies still exist on back-ups somewhere. Regrettably, log servers are not often backed up. They are usually overwritten every 30 days with the news of the moment.
It’s also likely any little app running under a LXC container would be gone as well.
But it’s also unlikely routers were used to alter an application and database. They should start there and look outward.
Look at THOSE connection histories, which they have to back up and preserve for several years, by law.