So consumer grade routers are a security risk, but not ISP switches or server routers? That’s the opposite of what a state level actor would look for.

I mean, it’s kind of old news that these consumer routers make up the majority of bot nets, although I doubt requiring them to be US-made will change much.