You should assume your IoT junk is already compromised, that's why your IoT junk runs on a dedicated VLAN.

What kernel is the router managing these VLANs running?

An updated one 'cause you're running a virtual router in a container or VM which gets all the updates your server(s) get.

They're on a dedicated VLAN in the county dump

Desktop Linux in typical setups? Consumer modems and routers?

[dead]