The AT&T router I have has an "IP Passthrough" mode which basically does a DMZ with my downstream router, but the router receives a public IP address. The AT&T router is essentially "invisible", but it takes up so much physical space, power, costs me $10/month, and is one more link in the fragile chain between me and the Internet.

Other comments here mention how to put the AT&T router behind a Ubiquiti gateway and proxy the authentication to it via some scripts. This reduces the reliance on the AT&T router for direct traffic, but you still need the router operational for those authentication handshakes.

Yes, you're correct, it is a double NAT.

The latency measured inside is around 9-11ms, so much higher than the 3-4ms measured at the ATT gateway.

I am not doing any port-forwarding, but I can definitely see it run into all kinds of problems, or require some configuration beyond my simple skills.

I'll investigate your comment: The best-of-both-worlds solution here is to have the outer ISP-provided router put your own router into some kind of DMZ, or use a bridge mode if the ISP router provides it. This basically turns your ISP-provided router into a dumber modem, and leaves all NAT and routing to your own hardware.