For many years there's been a linux router and a DMZ between VDSL router and the internal network here. Nowadays that's even more useful - LLM's are confined to the DMZ, running diskless systems on user accounts (without sudo). Not perfect, working reasonably well so far (and I have no bitcoin to lose).