A router by definition is a firewall. Not an enterprise class firewall, but one that redirects traffic and drops things not meant for the PC on the other side. That takes care of the bots.
SSL: I haven't seen a financial site in years: bank, or payment page like PayPal that's not HTTPS AT the login page. In the beginning its true that your login info was not protected. But not anymore.
I'm not sure what a "compromised" router means? Its a stupid box that virus' can't touch. It routes outgoing traffic out and routes traffic back in to the IP that asked for it, never exposing the IP's behind it.
If its set up correctly and passworded (so not only do you need the password of the router, you also need the password to get into the rtr setup to config a redirect), and you aren't logging in every 15 minutes to fiddle with it, then its highly unlikely someone in a CG is going to figure it out. I'm also now aware of any router that you can config a global redirect. It's usually a one for one, directing juniors favorite porn site, facebook, etc., back to Disney
Its good to be paranoid these days, but this is a rural campground not the Goggle campus.