> You become vulnerable for all sorts of MITM attacks. The attacker now also has access to your LAN, which is usually trusted by all devices on it.

Good points; these two issues are quite different.

You could stop the network-access problem by putting an extra router (a secure one) between the modem and your local network, but that wouldn't save you from MITM.

You mean you're not using end to end certificate based encryption for all your applications these days?

And all the pushback we get from people here that DoH/DoT is a bad thing.

Not all applications are, and there are specific automated downgrade attacks for encrypted comms that force some back to plaintext. Giving outsiders access to your internal network is rarely a good idea.

You're implying we shouldn't bother with firewalls

It's not my applications, but applications that auto-update over unencrypted HTTP. Also, IoT devices with software built by the lowest bidder.

Many or most devices don't support this and the average consumer isn't capable of doing it himself.