You should almost always buy a 'dumb' cable modem and have your own router that you manage behind it. These devices are commonly behind on firmware and may have completely insecure settings that you'll never have insight into.
Having an outdated firmware (which could be solved by mandatory updates from the ISP, which appears to be the direction AT&T is going) is still much better than having no firewall at all. An incredible minority of people, who “manage” their household internet access are aware of any of this.
If your firewall has exploitable outdated firmware, I might argue it's worse than no firewall because now you potentially have malicious code living on your network. Whereas if you don't have a firewall (on a home network) there generally isn't anything someone could get into anyway. "Oh I see port 22 is open." Great, there's nothing to SSH into anyway, who cares?
Most of the new stuff comcast ships is an "all in one" device that acts as an access point, a router and a cable modem. You can buy third party cable modems that do what you describe but what comcast gives you is much more fancy.