While I would say sending MAC Addresses and Wi-Fi names is very far from tracking everything you do on the internet, this highlight another very important point: The routers that provided by ISPs are usually very cheap and crappy, and this in itself security implications.

Like this example of pulling a script from an unverified HTTP source and executing it as root 🤯.. Not to mention that firewalling and port forward configuration options may be pretty simplified and limited.