[goatinaboat]

How exactly would I go about avoiding consumer routers when every provider in my area forces me to get some kind of modem with built in router and wifi?

It is a ridiculous situation, but I actually have our provider-provided router connected straight into a real firewall, and that in turn connected to a switch which in turn has the wifi base stations connected to it.

This means that if the first router is compromised there is a chance it won't penetrate the household, but of course the first router could still be used e.g. as part of a botnet by an attacker.