What about people using the guest network feature, e.g. small shop owners?
Well, this only affects Back to My Mac. If that is disabled, this won't matter; if it is enabled, Macworld reports that the worst that could happen is someone gaining access to the computer's or router's logon screen. The Heartbleed-esque "leak" of passwords doesn't seem to be a possibility, but even if it were, I suspect the fact that the guest network is a separate vLAN would help immensely (although maybe that would really only protect the clients from one another...).
Totally agree. We did not know that this model was affected until the fix was released. Suspect, we wont know if the older model is affected until the fix is released. As for those saying that the affected version of OpenSSL was not around when the older models were released. The OpenSSL version with the problem has been around for two years.
I don't know: Apple says, "this vulnerability only impacts recent Airport devices that have the Back to My Mac feature enabled. Customers with previous generation AirPort Extreme and AirPort Time Capsules do not need to update their base stations." While the second sentence alone could be consistent with what you said (in that they could mean "...at this time"), the first seems to indicate that Apple doesn't think it is affected by this problem.
As for the OpenSSL version, the fact that it was released before Apple released a product doesn't mean anything. They aren't obligated to use 1.0.1 just because it was released; OpenSSL is still providing updates for 1.0.0 and 0.9.8, the latter of which I believe Apple was still using in products that did use OpenSSL but are not affected. I don't think Apple has been very clear that this vulnerability is, in fact, Heartbleed, but if it is, it isn't too unreasonable to assume that they would not be affected for this reason.