Until there is some legally required amount of time to provide security updates for connected devices, I would expect the "buy a new one if you want to be protected" response to continue indefinitely.
At one "legal training" class our lawyers said that there is the potential that we could be required to recall and fix any product we have ever made. We have machines we made in the 1950s that are still regularly used for the purpose they were bought for, but without modern safety standards. We believe we can argue in court that the modern safety devices didn't even exist back then so we shouldn't have to update those machines, but we are not entirely sure and there is always the possibility that the legal framework could change. We have an official policy that once a recall is made, the replacement parts for a safety issue will be available forever, or until we can prove all existing machines have either been updated or scrapped. (The latter is considered impossible to prove and so there are kits available for machines that last shipped in the 1980s.) This policy has in fact protected us in lawsuits: we take safety seriously so mistakes are taken as unintentional and punitive damages don't apply.
I would expect a consumer router to run without problem for not less than 10 years: they should update it to work. Now they shouldn't have to add support for the next protocol or feature, but if it isn't secure that is different and should be fixed. All it takes is a lawyer.
Note that you don't have to have the affected router, just prove that an affected router is attacking you. I think there are people in IT who are able to prove this latter one so all that is left is bring it to your lawyers to get dlink to pay your costs from the attack.