The key is defense in depth. Don’t trust anything more then you need to. Even if your router is compromised the hosts should be hardened, the traffic should be encrypted, etc
Pascal breathing heavily in the common room
Why not run a wire guard server? If you need to access internal things connect to your wire guard server.
A docker image