So VPN users were the target? Presumably, the VPN provider would be using one of these routers, right?
It would appear so from what the article states. More likely the router itself would be the culprit, from what I glean skimming through the article.