Yeah I know, i have turned down 2 potential ISPs already, because they use cgnat. Too bad, because they are cheaper. Just wish ipv6 would really catch on soon.

Yeah, I just made a quick script that queries my public IP every 5 minutes, then changes the a-records via the registrar's API, if it detects a change.

I don't particularly agree with this. Systemd puts it there as an option to use. They are not responsible for what others systems do with this data, or if you choose not to enter anything into this field. It is completely optional at this level.. If you want to fight it, fight the politicians that makes these laws...

I have a 7 year old LG Smart TV(webos), on a vlan without internet access. Using the built in integration "LG WebOS TV” for automations. I used to use WOL for turning the TV on, but nowadays it seems like my shield works fine to turn it on over CEC.

If you are worried about the security of the brand name WiFi router, i would just try to set up pfsense on a stick(need only one NIC). I am pretty sure i have seen an official guide for that.

So basically, you plug your switch (access port) to the isp router, and plug the pfsense box into another port(trunk port) on your switch. Define a vlan for internet, and have that access port tagged with the same vlan. Then turn off routing in your brand name router and use it as a pure access point. Now you can play with vlans as much as you want

I wouldn't worry about the isp router, it has no access to your network, and most traffic going through it should be encrypted anyway. And for your brand named access points, you can block them from accessing internet.

Edit: The guide: Official documentation for "router on a stick"