In order to deploy these rootkits, someone needs device access. Imagine that you're using two-factor authentication to login, and logging all commands entered to a hardened, unmodifiable syslog server. If someone attempts to install the rootkit, there will at least be an audit trail that can be used against them (assuming they weren't smart enough to block the system log messages that indicated it was installed).

Once there is more information, this should be easy to identify measures to mitigate this risk.

A scary scenario would be a remote code vulnerability that allowed for a remote rootkit install. This would allow a worm to be created. The only thing you can do here is make sure you keep up on vulnerabilities and firmware releases, and hope Cisco writes better code ;)