A post on Slashdot says that Merlin patched the CVS in March. Merlin also patched the EOLed RT-AX56U, which Asus isn't providing an updated firmware for.
Despite the costs starting to creep up as my sites start taking up more space and bandwidth, I continue to host my sites and register my domains on NFSN because of the geek/DIY/libertarian ethos and the excellent support provided by Jeff the few times I've needed it. Though unconventional in a world full of cheap "unlimited" hosting, I trust that NFSN will conduct themselves with integrity if I have any issues with my site or domains, and that's a lot more important than saving a few dollars a month.
Since the start of the pandemic I've been self-hosting a Jitsi instance on Linode for my hypnotherapy business -- partly to transmit high-bitrate audio, partly for privacy and partly for compatibility, since it works in most web browsers. It works well even internationally (over a broadband connection), to the point where I won't even consider commercial software for this use case.