Right it is always someone elses fault. In reality though it becomes both your own and Netgears problem, since your name is being so clearly fronted to the end user. Maybe I would not have been so skeptical about it if the experience otherwise with duma had been ok. One firmware update messed up the entire configuration of the router showing nothing but a cryptical error message, just to mention one example.
I would say it is inconclusive whose fault it is to this date without an in depth investigation, but it does not matter. You still have a lot of more power than the end user to do something about it since I am guessing Netgear is not using your software in their routers for free. If I owned a company I would also not want my business to be associated with ignored security flaws no matter whose fault it is.