That's pretty horrifying but if true it answers my question about how this can affect so many devices. It sounds like whether because they were the directly hacked devices or because of this UPnP flaw, home routers are the main villain here. Not smart lightbulbs and webcams which the news media seemed to want to blame -- though the latter may well have been secondary villains.