Big carriers usually have their own IOS images, especially built for them. I don't know if they get updates earlier or later, but I suspect they get them earlier. I think the rule is that bigger carriers install updates only if they are required (they use the vulnerable service), smaller ISPs update later and the big enterprises never. I have seen enterprise routers with IOS version 9. The big carriers actually care about security but they don't tell everyone. The network and its availability is their business and money. Ask Raven Alder about this subject.

How should Cisco users protect a particular device such as a router, since it is directly connected to the internet and you cannot put a common firewall before it?

Common sense: pretty much nobody from the Internet has a good reason to talk to your router directly (as in the packet's destination IP address is the router's interface address). There might be exceptions to this rule, BGP for example, but these are just a few. A border router does not need to expose any service to the outside world, other than forwarding packets and sending a few ICMP messages IMHO. If your router does not parse attacker provided data, it cannot choke on it.

Are routers built by other companies more secure? Or maybe they are just a smaller market, and so a less interesting target?

Most of the smaller vendors actually produce much less secure devices. Especially the SOHO market is full of real bad routers. The other big vendors score differently. Overall, Cisco is the one that received [the] most attention (and even that is very little). People told you to use Firefox since IE is insecure. Since everyone uses Firefox, lots of bugs are found. It's the same with routers. If everyone starts to use Juniper, vulnerabilities will be found there.

Would it be possible to port an open-source OS such as Linux or BSD to these devices? Do you know any active project?

There have been ports of Linux to Cisco 2500/3000/4000 devices. But I don't think that's a scalable idea. Much of the power in Cisco routers comes from specialized hardware working hand in hand with IOS, for example when parts of the routing table are offloaded to special line cards. If you want to replace your Cisco IOS with open source software, I would recommend fast PC hardware and your preferred open source operating system. I hear good things about OpenBSD's BGP implementation.

Is there anything else you would like to add? I think you could have some interesting curiosities or experiences to share; maybe something about the rumored NSA backdoor, bundled features for eavesdropping, or industrial espionage (by the Chinese).

The bundled features for eavesdropping will be interesting, since you need a lot of code and functionality to make this work. Remember, the providers are not supposed to know if the police is listening in. So, what's sold to the general public as means to protect them from terrorists is probably going to be exactly the one feature with the most holes in it. Interesting, isn't it? And building this feature on top of SNMP probably wasn't the smartest idea.