Upgrading Samba brings multiple problems.
1) Newer versions of Samba are much, MUCH bigger. Samba 4.x would take over half of the flash space of an RT-N66U for instance - it simply wouldn't fit with the rest
2) Samba 4.x is a nightmare to cross compile. Netgear recently updated some of their routers to 4.x, and to do so they had to manually compile some elements and then insert these precompiled elements within the regular compile process. I have achieved the same thing myself on Asuswrt in my own tests, and scrapped the whole project because of the silly size of the resulting Samba footprint
3) Samba 3.6.25 is fairly painless to cross-compile, and there are patches for it to make its size ab it more manageable. It would still be potentially too big for low-end router models
4) The SMBv2 protocol carries close to 10% performance hit due to its higher CPU usage when running on a low-powered router. On high-end models that can barely reach 60 MB/s, we're talking dropping to 50 MB/s on average. On low-end models I didn't even bother benchmarking it...
5) And upgrading to 3.6.25 is of limited usefulness, since that version is already EOL
In theory, Asus could move to 3.6.25 (they could even reuse all my code there to save up development time - I've had 3.6.25 working for years on my firmware). But it also means dealing with users complaining about performance loss (some people complain when they see a dip in 2% in performance and refuse to upgrade their firmware because of this!), and it also means having to deal with the impact for lower end models like the RT-N300. And it wouldn't address the long-term issue of lack of security updates.
The biggest problem here ultimately is Samba itself. Samba devs don't really care about the embedded market, and are more interested in NAS/server implementations, as seen by their work on adding Active Directory support and such. The embedded market need an alternative to Samba, and so far there is none.
When someone asked the Samba devs a few years ago about better embedded device support, their answer was "Sure, send us patches, and we'll consider implementing them". In short, they're not going to devote development time on this.
