Is a wireless router a security risk?

Not any more than the patriot act.

The only aspect of a router (NAT variety) is they perform the function of a firewall, which does not stop malware: it only stops unsolicited data packets (things not requested by an Internet Browser, or application already behind the firewall). Unrequested packets are 'dropped' or blocked, outside the firewall/router.

It has no analytic capacity: it merely verifies the legitimacy of inbound & outbound traffic headers.

So if the requested webpage has an 'asset' from the site or 1st party (or 3rd party) that is malware, it is dutifully returned as requested, because the 'header' is verified as legit.

►►Asset fetching is done automatically by the browser unless users modify that behavior.

Your anti-virus, anti-malware, browser configurations, and other layered defenses should be deployed for defensive tasks.

Tell your friend to constrain the browser, by turning off 3rd party asset fetches for starters. That would be in the "Privacy" area> Turn off 3rd party cookies.

Deliberate use of 'dark' sites, like p-2-p file sharing; porn; free applications; etc., will eventually defeat any Windows security.

Also, since iE is such a loose browser, move to Firefox, and get "NoScript".

https://addons.mozilla.org/en-US/firefox/collectio...

Many other security/privacy items there as well.

Encryption keeps the perverts or other criminals from parking in you driveway and using your internet service as their own.

It does nothing to intercept malicious scrips, and even less to prevent a user from visiting risky websites, downloading risky content, or opening risky e-mail content.

Even with an encrypted router, most users still need quality virus protection.