There are two things going on here.
First of all, while the OSI seven-layer model is a nice tool to learn about protocols, it's only a model. In the real world, devices don't stick to a specific layer just because it's such a nice theory; in order to deliver desired functionality, a device will happily violate layer boundaries whenever necessary. For example:
- Switches using IGMP Snooping or DSCP-based QoS look into
layer-3 (IP) headers to make decisions.
- Routers can use application recognition (like NBAR) all the way upto layer-7 to be able to prioritise important traffic over
catvideo's on YouTube.
This is useful and desired behaviour, so there is no reason to 'prohibit' this.
Secondly, a router requires a lot of different components to be able to fulfill its function as layer-3 packet forwarding device.
- It's running a management daemon where you can login to manage the device using higher level protocols (SSH, HTTPS, SNMP, or perhaps
even something like NETCONF or a REST API).
- It's running a routing daemon that communicates with neighboring routers using some protocols (OSPF, BGP, etcetera) to exchange information and populate the routing table that is used to forward
- And, in fact, many other daemons that server different purposes.
With all these daemons, the device is not that different from a regular endpoint. If you want to stick to the OSI-model, you can see the router as a server running (routing-)applications (layer-7), which is uses to program a layer-3 forwarding component.