Infected devices usually try to spread the infection further and their scanning attempts on the Internet are often observed. There is for instance a dedicated website for IoT devices attacking Telnet ports or some more generic ones, such as the Internet Storm Center. If the IP address of your device is on the list, it is very likely that you have a problem.
Here is a website where you can test if your device has such a problem, because it has been observed in Telnet honeypots for quite some time - https://amihacked.turris.cz/
"According to the experts, several attacks have been detected in the wild," - well, have a look at this article. It is about more than 6 million devices, 1 million of it being for sure IoT stuff like cameras and the likes. It is very likely they are talking about the same attack described here.
Have a look at Turris Omnia - the LEDs are dimmable in 8 steps, the last one being completely off.
Their previous offering, "Router Turris," despite having a reference design and being claimed as "open source hardware", used the Qualcomm QCA8337N-AL3C, so it isn't really open hardware, either, and is much more closed than hardware which doesn't require binary blobs to work (well).
You dismiss the previous boards as not being open hardware solely based on your conviction that the QCA8337N-AL3C requires binary blobs to run. However, this is not true, just check with the OpenWrt people.
I'm always looking for a new idea that will be more productive than its cost. -- David Rockefeller
