You seem to forget that grandparent is British...

Actually the above firewall rules only block access to the web server, telnet server and ssh server running on the router itself, not the forwards to the Internet (the rules are appended to the INPUT chain, not the FORWARD chain).

That would be kind of stupid anyway, because the user would notice this rather quickly, and probably power cycle the router because his Internet doesn't work. Kinda pointless to make it obvious there is something wrong when your goal is to run a botnet...