I went the Flint 2 route, I do not currently need wifi 7 but I did flash it with vanilla Openwrt. With the clean vanilla OpenWRT I have added 2 VPNs, I am considering adding a third (one is personal, one is to show off to friends, and the third one will be for my off site back up). I have a poop load of vLANs (IoT stuff, home lab stuff, my personal stuff, guest stuff, child safe vLAN, Personal VPN vLAN, guest VPN vLAN). I have a bunch of wifi APs, (personal, guest, kiddo safe, IoT, and a few because I am an asshole and believe all them waves belongth to me!).

My plan was to host my own email server but this girl loves her hair and did not want to pull it all out, so I just continued on using a third party for that, this is why I got a firewall I controlled because I needed static IP addresses for email but I would recommend getting one if you are adding your own firewall just to by pass everything your ISP is doing, I have fibre but even when I had DSL my ISP had to keep their modem in there, port 1 is just a dumb switch that goes to my firewall.

Originally I had a VPN running on a pi zero 2 (do not do this it is not that great to do it), but now my Flint 2 takes care of it and I do not notice any slow downs when I am away from the LAN. As a Canadian my PM just recently said we are at war with the US, sure it is a trade war not a pew pew boom war but war non the less and as an ex-Apple fan girl I was already slowly moving my stuff away from Apple things and use a pi 4 for HA I have a pi 5 running a bunch of services including pihole, would highly recommend, I have another pi 5 running stuff, and a pi zero 2 running my secondary pihole. I would highly recommend pihole to anyone who is just starting home labbing or been at it for a while, there is some disagreement with people who use other ad blockers but I found pihole first and feel in love with it. You will be so glad to have a VPN with whatever ad blocker you choose (pihole). But getting a static IP is a good idea, sure there are hacks to get things working with things like duckdns.org, your own domain, or whatever else.

You mention hackers and bots, I have crowdsec running on my firewall with things going to all my other devices and a honey pot on my pi zero 2, but my suggestion is if you do not want to set up crowdsec and just rely on the firewall make sure you use strong passwords, I have vaultwarden for those, and change your ssh ports on your devices and while you are at it do not use anything in the 8080 port range.