to me, the router is a tiny, weak kneed general purpose computer that has some network interfaces, some baked in daemons (including a web server, usually lighttpd), that lacks a keyboard or mouse.
it comes pre-configured to route packets across its interfaces, and serve http requests on the private interface.
in most cases, you can send it a "magic packet" on the private interface, and it will open up a root user remote console, that you can use to poke about and change things under the hood. a reboot usually undoes all the changes unless you use a custom firmware with jffs support.
I can get the things to do everything from straight up emulate battle.net for older blizzard games (pvpgn daemon running), to function as a tor exit node, to mining bitcoins, to downloadng from bittorent direct to a usb stick, to getting it to host remote ncurses console games like Nvaders. (a space invaders clone)
the devices are already laughably easy to hack. again, just send them the magic packet, and then batter down the login on the remote console.
the deal is that they are just one uninteresting device among billions, unless you MAKE it interesting somehow, and serving interesting files makes it interesting.
google will happily publicise your file listing, whether you want that or not, and people interested in your files that you did not invite, will start hammering your server to get them.
in my case, i had a password protected section running with an .htaccess control file that had an authorized user account that needed to be logged into to get to my private cloud storage. I had some MP3s in there that I streamed to myself before itunes was even a thing.
the login data and the links to my music archive started showing up on google, and I stated getting swamped with malformed url attacks, heavy portscans, malicious put requests, and gods knows what all else. I had to take it down. the user login data was NOT used as a system user on the host, so all that their exploit to read the .htaccess file got them was how to get at my music, but still, they turned a personal host into a pirate server overnight by leaking how to login, and where to leech my music.
it was a more innocent time back then, these days it would be even worse.
use the cloud service, and watch what you put on it.