I use them for wifi because they make them really easy to configure and manage. But the management interface stays locked in a vlan without access to the internets. Because I don’t trust their cloud affinity.

This also disqualifies their routers and firewalls for me. How can I trust a device which tries to phone home? So that area is covered by opnsense on a device with a sufficient amount of Ethernet ports.