A post on Slashdot says that Merlin patched the CVS in March. Merlin also patched the EOLed RT-AX56U, which Asus isn't providing an updated firmware for.
Despite the costs starting to creep up as my sites start taking up more space and bandwidth, I continue to host my sites and register my domains on NFSN because of the geek/DIY/libertarian ethos and the excellent support provided by Jeff the few times I've needed it. Though unconventional in a world full of cheap "unlimited" hosting, I trust that NFSN will conduct themselves with integrity if I have any issues with my site or domains, and that's a lot more important than saving a few dollars a month.