CISA's new binding operational directive comes amid persistent concerns about nation-state adversaries targeting end-of-service edge devices, like routers.