Maybe they can send some of this money to the Wuhan Institive of Virology to research respiratory viruses in bats and some to Raph Baric at UNC for vaccine development. What could go wrong?
If they didn't have RCE but could push config to the router, they might have pushed a syslog destination and then mined the logs. URLs for uncrypted HTTP requests could end up in the logs due to ALG, parental filtering or any other numbers of features. If you replayed such URLs from a large enough set of victims over a long enough period of time, you'd find something valuable in a response sooner or later.