Three separate implants in router firmware is the kind of thing that makes me want to see the update chain, not the press release.
If they were all hidden cleanly enough to ship worldwide, the boring part is going to be the trust model, not the malware.