I don't know of any routers running Microsoft Windows ... do you?
Much of the IoT junk coming from Asia may be running a Linux variant but poor programming practices will leave a device wide open.
Just as on a Mac, the underlying OS may be secure in a certain configuration but any dependent programs also need to be secured and regularly updated.