I agree, I’m a bit of a different case since I’m also colocating my equipment. I run a UDM Pro for all my IPMI with a VPN into that subnet, but everything else is running with public IPs.

Agreed. I have a personal modem and a separate router with openwrt acting, at least in part, as a firewall. Then each host also has its own firewall for extra protection.

I don’t even have an ISP router at all, my personal router is plugged directly into the fibre terminator.